Sniffer

When Enhanced Mode captures a TCP connection, Core may only know the destination IP. The sniffer reads the first bytes of the connection — the HTTP Host header or the TLS SNI — to learn the name and match domain rules against it. It does not decrypt anything.

The sniffer is on by default; you only need [sniffer] to change it.

[sniffer]
enable = true
protocols = ["http", "tls"]
http-ports = [80, 8080]
tls-ports = [443, 8443]
override-destination = true
timeout-ms = 500
max-bytes = 16384

Fields

Field	Default	Notes
enable	true
protocols	["http", "tls"]	http, tls (alias https)
http-ports	[80, 8080]	ports to read an HTTP Host from
tls-ports	[443, 8443]	ports to read a TLS SNI from
override-destination	true	send the sniffed name, not the IP, to the proxy
timeout-ms	500	how long to wait for the first bytes; 10–5000
max-bytes	16384	how much to read; 512–65536

Ports can be numbers, a "from-to" range string (at most 100 ports), or a list of both: tls-ports = [443, "8440-8450"].

Limits

• Only connections that reach Core are sniffed. With the eBPF backend and FINAL,DIRECT, a connection that matches no rule is never redirected to Core, so it is never sniffed.
• A protocol that does not expose a name (plain IP protocols, encrypted client hello) cannot be sniffed. Use IP or process rules for those.
• Sniffing adds up to timeout-ms of delay to protocols where the server speaks first. Keep such ports out of the port lists.