---
url: /apranik/configuration/routing/sniffing.md
---
# Sniffing

The settings of a [`sniff`](action.md#sniff) action, and what each sniffer reports.
Sniffing reads the start of a TCP connection; the destination is never rewritten.
A connection is sniffed at most once.

## Structure

```json
{
  "type": "sniff",
  "settings": {
    "sniffers": [{ "type": "tls" }, { "type": "http" }],
    "timeout": "300ms"
  }
}
```

## Fields

### `sniffers`

list of sniffers
Required

The [sniffers](#sniffers) to run.

### `timeout`

duration
Default: 300ms

How long to wait for enough bytes to recognise the connection.

## Sniffers

Neither takes settings.

| Type | Reads | Reports |
| --- | --- | --- |
| `tls` | a TLS ClientHello | the server name (SNI) and a browser-family guess |
| `http` | an HTTP/1 request | the `Host` and every header, with `:method` and `:path` |

Later rules read the results through `sniffed_protocol`, `sniffed_request_header`,
`sniffed_browser_family` and the [domain fields](rule.md#domain).