Darkstat - Nework
Traffic Analyzer or Network Monitor
What is Darkstat ?
darkstat is a network statistics gatherer.
Effectively, it's a packet sniffer which runs as a background
process on a
cable/DSL router, gathers all sorts of useless but interesting
statistics,
and serves them over HTTP.
Darkstat Features
Traffic graphs.
Tracks traffic per host.
Tracks traffic per TCP and UDP port for each host.
Embedded web-server with deflate compression.
Asynchronous reverse DNS resolution using a child process.
Small. Portable. Single-threaded. Efficient.
Download Darkstat
http://dmr.ath.cx/net/darkstat/
Installing Darkstat in
Debian
#apt-get install darkstat
Reading package lists... Done
Building dependency tree... Done
The following NEW packages will be installed
darkstat
0 upgraded, 1 newly installed, 0 to remove and 15 not upgraded.
Need to get 59.7kB of archives.
After unpacking 426kB of additional disk space will be used.
WARNING: The following packages cannot be authenticated!
darkstat
Install these packages without verification [y/N]? y
Get: 1 http://mirror.ox.ac.uk stable/main darkstat 2.6-7
[59.7kB]
Fetched 59.7kB in 0s (264kB/s)
Preconfiguring packages ...
Selecting previously deselected package darkstat.
(Reading database ... 41155 files and directories currently
installed.)
Unpacking darkstat (from .../darkstat_2.6-7_i386.deb) ...
Setting up darkstat (2.6-7) ...
This will finish the installation.Once you finish the
installation you need to edit the the file located at
/etc/darkstat/init.cfg
# Turn this to yes when you have configured the options below.
START_DARKSTAT=no
to
START_DARKSTAT=yes
Now you need to start the darkstat using the following command
#/etc/init.d/darkstat start
This will start the darkstat process
If you want to run darkstat from command line
#darkstat
darkstat v2.6 using libpcap v2.4 (i386-pc-linux-gnu)
Firing up threads...
Sniffing on device eth0, local IP is 172.2.15.10
DNS: Thread is awake.
GRAPH: Starting at 38 secs, 42 mins, 8 hrs, 30 days.
Can't load db from darkstat.db, starting from scratch.
ACCT: Capturing traffic...
Point your browser at http://localhost:666/ to see the stats.
Now you can access your network monitor using the
http://youripaddress:666
If you want more options and How to use darkstat check darkstat
man page
Darkstat Screenshots
Here is the some of the screenshots for darkstat
v2.6
Main Screen
Hosts Screen
Hosts screen you can see all the
machines which take part in the communication. These can be
arranged by the caused traffic or their particular IP address.
Ports Screen
Ports Screen you can see the port
numbers which are used by server and client applications. You
can immediately recognize the port numbers which are used by the
following daemons: 666 (darkstat), 80 (http)
Protocols Screen
Protocols Screen protocols
ICMP,TCP,IGP and UDP for the file transmission, which were
involved in the communication event.
Graphs Screen
Graphs Screen screen shot
shows a summary of the collected time periods as graphs
