darkstat(1)

NAME
darkstat v3 - network statistics gatherer

SYNOPSIS
darkstat [ -d ] [ -n ] -i interface [ -p port ] [ -b bindaddr ] [ -f filter ]

DESCRIPTION
darkstat is a network statistics gatherer.

Effectively, it's a packet sniffer which runs as a background process on a cable/DSL router, gathers all sorts of useless but interesting statistics, and serves them over HTTP.

All settings are passed on the commandline.

  OPTIONS

-d  Detach from the controlling terminal and run in the background.

-n  Do not use promiscuous mode to capture. Note that an interface may already be in promiscuous mode. If this is a problem, use an appropriate bpf(4) filter.

-i interface
    Listen on the specified network interface. This argument must be supplied.

-p port
    The embedded webserver should bind to the specified port. The default is 667.

-b bindaddr
    The embedded webserver should bind to the specified address. The default is to listen on all interfaces.

-f filter
    Passes the specified packet filter expression to libpcap. The filter syntax is beyond the scope of this manual page; please refer to the tcpdump documentation.

USAGE EXAMPLES
To gather statistics on the fxp0 interface:

    darkstat -i fxp0

We want to account for traffic on the Internet-facing interface, but only serve web pages to our private local network:

    darkstat -i fxp0 -b 192.168.0.1

We want to serve web pages on the standard HTTP port:

    darkstat -i fxp0 -p 80

We are on Optus (cable) and don't want to account for the constant ARP traffic we are receiving:

    darkstat -i fxp0 -f "not arp"

We only want to account for HTTP traffic:

    darkstat -i fxp0 -f "port 80"

(For a full reference on filter syntax, refer to the tcpdump manpage)

TROUBLESHOOTING
If you are using PPPoE (for example, on an ADSL line), and sniffing on an ethernet interface, you might see warnings about PPPoE packets:

    ether: unknown protocol (8864)

In order to get usable statistics, you need to sniff on the tunnel interface that your PPPoE software provides. For example:

    darkstat -i tun0

Or, on OpenBSD or NetBSD, sniff on the pppoe interface:

    darkstat -i pppoe0

SEE ALSO
tcpdump(1)

AUTHOR
Emil Mikulic, and others (see AUTHORS and THANKS).

WEB
http://purl.org/net/darkstat