DARKSTAT(1)

NAME
darkstat - network traffic analyzer

SYNOPSIS
darkstat [ -i if ] [ -p port ] [ -d path ] [ -l ip/mask ] [ -v ] [ -h ] [ -V ]

DESCRIPTION
darkstat is a network traffic analyzer. It's basically a packet sniffer which runs as a background process on a cable/DSL router sort of machine and tallies up all sorts of useless but interesting statistics.

All settings are passed on the commandline.

  OPTIONS

-i if
    Listen on the network interface specified by if, rather than the default interface that libpcap returns.

-p port
    Serve statistics on the specified port instead of the default 666.

-d path
    Store database files in path instead of the current working directory.

-l ip/mask
    When running a 2.4.x Linux kernel with NAT, packets are mangled before libpcap catches them. To get proper accounting of transfer statistics, you have to describe your local network address space.

    For example, if all the local machines have an IP of 192.168.0.x, your ip/mask should be 192.168.0.0/255.255.255.0.

-v  Enable verbose mode. You will see lines of text about packets begin processed and some verbose information about what the DNS and WEB threads are doing.

-h  Displays the help/usage statement.

-V  Displays the version information.

WHY?
I have a cable router at home that runs Linux and I like having some statistics about the data that's going through it.

I'm a big fan of ntop and I've been using it for a long time. darkstat is an effort to create a smaller (in terms of memory footprint) and stabler ntop.

WHY YOU SHOULD BE USING NTOP
ntop is the original swiss-army-knife of network statistics. It's tried and proven. If you want something that will work out of the box, you should be using ntop. Also, ntop works on most flavours of Unix while darkstat is mainly geared toward Linux. (Although it works pretty well under FreeBSD and will compile on Solaris with minimal adjustments)

http://www.ntop.org/

WHY YOU SHOULDN'T BE USING NTOP
If you're having issues with ntop's memory footprint or stability then you might want to give darkstat a try.

The code is a lot simpler and shorter so it's a lot easier to implement any sort of custom monitoring you need. darkstat doesn't bother with multicast and non-IP protocols like ARP (if you need accounting for those, use ntop) but it does accounting per local port (which ntop doesn't.)

SEE ALSO
pcap(3)
http://freshmeat.net/projects/darkstat/
http://members.optushome.com.au/darkmoon7/net/darkstat.html