Tip of the Trade: Darkstat

Darkstat is a lightweight network traffic grapher run from a router that collects traffic statistics, exports them to HTML pages and serves up the pages on its own mini-HTTP server.

Darkstat is an excellent, lightweight network traffic grapher designed to run on a router, collect traffic statistics, export them to HTML pages and serve up the pages on its own mini-HTTP server. It is often compared to Ntop, but the Darkstat author claims it is faster and more efficient, and should run fine, even on low-powered routers without bogging them down. Darkstat is a great alternative to heavy-duty network monitors like MRTG, Munin, and Nagios. It is a quick and easy utility that takes quick snapshots of a network’s activities.

You must first make some changes to Darkstat’s configuration file, /etc/darkstat/init.cfg:

# Turn this to yes when you have configured the options below.
START_DARKSTAT=yes

# Don't forget to read the man page.


# You must set this option, else darkstat may not listen to
# the interface you want
INTERFACE="-i eth0"

PORT="-p 666"
BINDIP="-b 127.0.0.1"
LOCAL="-l 192.168.1.0/24"
FIP="-f 127.0.0.1"
DNS="-n"

#SPY="--spy eth0"

Then, run:

# /etc/init.d/darkstat start
Starting darkstat network daemon: darkstat.

Give it a few minutes to collect some statistics, then point a local Web browser to http://localhost:666. It will generate graphs and tables of your network activity.

The spy option captures HTTP requests and logs them to darkstat.spylog.YYMMDD. I’m not sure why you would want to do this, but it’s there if you want it. See man darkstat for descriptions of different options.