Troubleshooting

Use this page when offline mode starts but does not produce the files or behavior you expect.

No connections.ndjson File Appears

Check these first:

1. Confirm sniffer.mode: offline
2. Confirm you did not use --dry-run
3. Confirm the output path is writable
4. Confirm packets matched the configured BPF filter
5. Check the sniffer log file

Example:

tail -100 /var/log/pqc-sniffer/pqc-sniffer.log

Permission Denied on Live Capture

Live capture typically requires root privileges or equivalent packet-capture capabilities.

sudo ./build/pqc-sniffer --config ./offline.yaml --foreground

PCAP File Does Not Process

Make sure:

• the path exists
• the file is readable
• the configured capture.interface points to a .pcap, .pcapng, or file:///... input

Config Validation Fails

Run:

./build/pqc-sniffer --config ./offline.yaml --validate-config

Common causes:

• non-absolute offline_output.output_file
• offline_output.output_file contains ..
• invalid buffer or rotation values
• missing required sections

Logs Look Fine but Output Is Empty

This usually means one of two things:

• no traffic matched the BPF filter
• the capture source did not contain the handshake or protocol events you expected