18. Darkstat

1. What is darkstat?

It is a program that captures network traffic, calculates statistics about usage, and serves reports over HTTP.

It offers the following features:
  • Traffic graphs, reports per host, shows ports for each host.
  • Embedded web-server with deflate compression.
  • Asynchronous reverse DNS resolution using a child process.
  • Small. Portable. Single-threaded. Efficient.
  • Supports IPv6.

2. Installation

It is better to do a first installation from the repositories:

sudo apt-get install darkstat

We can then run darkstat:

darkstat -i eth0

Although it's possible to configure / complicate things further, once out of the box, darkstat will just work without much trouble on your part.

You can check the information by opening a browser in http://localhost:667.

3. Version 3.0.175

The version in the repositories is right now 3.0.173.
This version does not allow
sorting on last-seen but the new one does.
If you are interested, install the new version, first remove the installed package but do not do complete removal, since we will still be still using some configuration files.
Download the .tar.bz2 file from the official site and just follow the steps in the INSTALL file to compile and install the new version.
Probably you will need to create the folders /var/empty and /var/lib/empty.
You need also to change permissions to the folder /var/lib/darkstat and give permission to read and write to the user nobody.

If you wish to get darkstat up and running automatically at start up, follow these simple steps:

i) Edit /etc/darkstat/init.cfg and change No to yes. Change anything else you need and save the file.
ii) Edit /etc/init.d/darkstat and add /usr/local/sbin to the PATH and change the path for the DAEMON too, since it is now located in /usr/local/sbin.

Now you are ready to fully enjoy this nice program.
It is very useful to get an idea of the traffic in your server and control it.

It is good to read the short manual by typing man darkstat in the command line.