<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<META http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<META NAME="GENERATOR" CONTENT="lfparser_2.50">
<META NAME="LFCATEGORY" CONTENT="SystemAdministration">
<link rel="icon" href="../../common/images/lf-16.png" type="image/png">
<TITLE>lf346, SystemAdministration: darkstat - a network traffic analyzer</TITLE>
<style type="text/css">
<!--
td.top {font-family: Arial,Geneva,Verdana,Helvetica,sans-serif; font-size:12 }
pre { font-family:monospace,Courier }
pre.code { font-family:monospace,Courier;background-color:#aedbe8; }
p.cl { color:#EE9500 }
table.left { margin-right:0.3cm }
a.nodec { text-decoration:none }
p.trans { font-size:8pt; text-align:right }
p.clbox { width:50%; alignment:center; background-color:#FFD700;
border-style:none; border-width:medium; border-color:#FFD700;
padding:0.5cm; text-align:center }
p.code { width:80%; alignment:center; background-color:#aedbe8;
border-style:none; border-width:medium; border-color:#aedbe8;
padding:0.1cm; text-align:left }
p.foot { background-color:#AAAAAA; color:#FFFFFF; border-style:none;
border-width:medium; border-color:#AAAAAA; padding:0.5cm ;
margin-top:0.1cm; margin-right:1cm; margin-left:1cm;
text-align:center }
div.tbbutton {
background: #ddd;
border-right: 1px solid #aaa;
border-bottom: 1px solid #aaa;
margin: 2px 5px 2px 5px;
text-align: center;
width: 20em;
line-height: 1.2em;
padding: 2px;
font-size: 12px;
white-space: nowrap;
color: #555;
}
div.bbutton {
background: #ddd;
border-right: 1px solid #aaa;
border-bottom: 1px solid #aaa;
float: left;
margin: 2px 5px 2px 5px;
text-align: center;
line-height: 1.2em;
padding: 2px;
font-size: 12px;
white-space: nowrap;
color: #555;
}
-->
</style>
</HEAD>
<BODY bgcolor="#ffffff" text="#000000">
<!-- this is generated html code. NEVER use this file for your
translation work. Instead get the file with the same article number
and .meta.shtml in its name. Translate this meta file and then
use lfparser program to generate the final article -->
<!-- lfparser can be obtained from http://main.linuxfocus.org/~guido/dev/lfparser.html -->
<!-- this is used by a number of tools:
=LF=AUTHOR: Mario M. Knopf
=LF=CAT___: SystemAdministration
=LF=TITLE_: darkstat - a network traffic analyzer
=LF=NUMBER: 346
=LF=ANAME_: article346.shtml
=LF=PARSER: 2.50
-->
<!-- 2pdaIgnoreStart -->
<!-- start navegation bar, current, style=2 -->
<!-- top navegation bar -->
<TABLE summary="topbar_1" cellspacing="0" cellpadding="0" border="0" align="center" width="90%">
<TR bgcolor="#2e2292">
<TD class="top"><TABLE summary="topbar_1_logo" cellspacing="0" cellpadding="0" border="0" width=
"100%">
<TR><TD width="319"><a href="../../index.shtml"><IMG src="../../common/images/logolftop_319x45.gif"
alt="[LinuxFocus-icon]" width="319" height="45" align="left"
border="0"></a></TD>
<TD class="top">
<TABLE summary="topbar_1_links" width="100%">
<TR align="right">
<TD class="top">
<A class="nodec" href="../../index.shtml"><FONT color=
"#DDDDDD" size="2"><--</FONT></A> |
<A class="nodec" href="../map.html"><FONT color=
"#DDDDDD" size="2">Map</FONT></A> |
<A class="nodec" href="../indice.html"><FONT color=
"#DDDDDD" size="2">Index</FONT></A> |
<A class="nodec" href="../Search/index.html"><FONT color=
"#DDDDDD" size="2">Search</FONT></A> </TD>
</TR>
<TR align="right">
<TD class="top">
<HR width="100%" noshade size="1">
</TD>
</TR>
</TABLE>
</TD>
</TR>
</TABLE>
</TD>
</TR>
</TABLE>
<!-- end top navegation bar -->
<!-- blue bar -->
<TABLE summary="topbar_2" cellspacing="0" cellpadding="0" border="0" align="center"
width="90%">
<TR bgcolor="#00ffff">
<TD><IMG src="../../common/images/transpix.gif" width="1" height=
"2" alt=""></TD>
</TR>
</TABLE>
<!-- end blue bar -->
<!-- bottom navegation bar -->
<TABLE summary="topbar_3" cellspacing="0" cellpadding="0" border="0" align="center"
width="94%">
<TR bgcolor="#000000">
<TD>
<TABLE summary="topbar_3_links" cellspacing="0" cellpadding="1" border="0" width=
"100%">
<TR align="center">
<TD WIDTH="20%"><A class="nodec" href="../News/index.html"><FONT color=
"#FFFFFF">News</FONT></A> </TD>
<TD WIDTH="5%"><FONT color="#FFFFFF">|</FONT> </TD>
<TD WIDTH="20%"><A class="nodec" href="../Archives/index.html"><FONT color=
"#FFFFFF">Archives</FONT></A> </TD>
<TD WIDTH="5%"><FONT color="#FFFFFF">|</FONT> </TD>
<TD WIDTH="20%"><A class="nodec" href="../Links/index.html"><FONT color=
"#FFFFFF">Links</FONT></A> </TD>
<TD WIDTH="5%"><FONT color="#FFFFFF">|</FONT> </TD>
<TD WIDTH="20%"><A class="nodec" href="../aboutus.html"><FONT color=
"#FFFFFF">About LF</FONT></A> </TD>
</TR>
</TABLE>
</TD>
</TR>
</TABLE>
<!-- end bottom navegation bar -->
<!-- stop navegation bar -->
<!-- SSI_INFO -->
<!-- tr_staticssi include virtual -->
<!-- tr_staticssi exec cmd -->
<!-- addedByLfdynahead ver 1.5 --><TABLE ALIGN="right" border=0><TR><TD ALIGN="right"><FONT SIZE="-1" FACE="Arial,Helvetica">This document is available in: <A href="../../English/September2004/article346.shtml">English</a> <A href="../../Castellano/September2004/article346.shtml">Castellano</a> <A href="../../Deutsch/September2004/article346.shtml">Deutsch</a> <A href="../../Francais/September2004/article346.shtml">Francais</a> <A href="../../Italiano/September2004/article346.shtml">Italiano</a> <A href="../../Nederlands/September2004/article346.shtml">Nederlands</a> <A href="../../Portugues/September2004/article346.shtml">Portugues</a> <A href="../../Indonesian/September2004/article346.shtml">Indonesian</a> <A href="../../Russian/September2004/article346.shtml">Russian</a> <A href="../../Turkce/September2004/article346.shtml">Turkce</a> </FONT></TD></TR></TABLE><br>
<!-- SSI_INFO STOP -->
<!-- 2pdaIgnoreStop -->
<!-- SHORT_BIO_ABOUT_THE_AUTHOR_AND_INDEX_START -->
<TABLE ALIGN="LEFT" BORDER="0" WIDTH="195" summary="about the author" class="left">
<TR>
<TD>
<img src="../../common/images2/MarioMKnopf.jpg" alt=
"[Photo of the Author]" width="150" height="130">
<BR>by Mario M. Knopf <a href="http://www.neo5k.org/"><font size="1">(homepage)</font></a>
<BR><BR>
<I>About the author:</I><BR>
<!-- aboutauthor_start -->
<p>Mario enjoys to keep busy with Linux, networks and other
topics concerning security related issues.</p>
<!-- aboutauthor_stop -->
<!-- TRANSLATED_TO en -->
<BR><BR><I>Translated to English by:</I><BR>
Mario M. Knopf (<a href="http://www.neo5k.org/"><font size="1">homepage</font></a>)
<br>
<!--
=LF=TRANSTO=en: Mario M. Knopf
-->
<!-- TRANSLATED_TO_STOP -->
<!-- INDEX_START -->
<BR><i>Content</i>:
<UL>
<LI><A HREF="#346lfindex0">Introduction</A></LI>
<LI><A HREF="#346lfindex1">Installation</A></LI>
<LI><A HREF="#346lfindex2">Start</A></LI>
<LI><A HREF="#346lfindex3">Starting options</A></LI>
<LI><A HREF="#346lfindex4">Handling</A></LI>
<LI><A HREF="#346lfindex5">Future prospects</A></LI>
<LI><A HREF="#346lfindex6">Conclusion</A></LI>
<LI><A HREF="#346lfindex7">Links</A></LI>
<LI><A HREF="http://cgi.linuxfocus.org/cgi-bin/lftalkback?anum=346">Talkback form for this article</A></LI>
</UL>
</TD></TR></TABLE>
<!-- INDEX_STOP -->
<!-- SHORT_BIO_ABOUT_THE_AUTHOR_AND_INDEX_STOP -->
<!-- HEAD_OF_THE_ARTICLE_START -->
<br>
<table border="0"><tr><td>
<H2>darkstat - a network traffic analyzer</H2>
<img src="../../common/images2/article346/darkstat.jpg" alt=
"[Illustration]" hspace="10" width="366" height="99">
<!-- ABSTRACT OF THE ARTICLE -->
<P><i>Abstract</i>:
<P>
<!-- articleabstract_start -->
This article presents the network traffic analyzer
"<i>darkstat</i>" and gives an overview concerning
installation, start and usage of this program.
<!-- articleabstract_stop -->
<br><!-- HR divider --><center><font color="#8282e0"><b>_________________ _________________ _________________</b></font></center><br>
</td></tr></table>
<!-- HEAD_OF_THE_ARTICLE_STOP -->
<!-- BODY_OF_THE_ARTICLE_START -->
<A NAME="346lfindex0"> </A>
<H2>Introduction</H2>
<p>"<i>darkstat</i>" [1] is a network monitoring tool, which
analyses the resulting traffic of a network and generates on
the basis of these data miscellaneous statistics as
HTML-Output. These statistics can be viewed comfortably in a
browser. For this purpose the author of the program, Emil
Mikulic, had "<i>ntop</i>" [2] in use for a long time. But he
was disaffected of its stability issues and its bad memory
behavior. For this reason he developed "<i>darkstat</i>". The
addressed statistics refer of the communication between hosts,
the caused traffic and the used port numbers alternatively the
involved transmission protocols. Additionally diagrams to the
collected time periods and a short summary of the analyzed
packets since program start can be regarded.</p>
<A NAME="346lfindex1"> </A>
<H2>Installation</H2>
<p>The sources of the program "darkstat" can be referred
directly under [3]. Alternatively also one of the two mirrors
can be visited at [4] and [5]. If someone looks for Debian
packages, he finds these under [6].</p>
<p>"<i>darkstat</i>" also depends, like a lot of other network
monitoring tools, on the "<i>libpcap</i>"-file [7]. This is a
library, which is used by packet sniffers and provides them an
interface to capture and analyze packets from network devices.
To install "<i>darkstat</i>" you need therefore this
library.</p>
<p>Then you have to compile it with the well-known three-set
"<i>./configure && make && make install</i>".
It is important, that the last instruction must be done
with root-rights.</p>
<A NAME="346lfindex2"> </A>
<H2>Start</H2>
<p>"<i>darkstat</i>" offers some parameters, which can be
set at program start. However, for a first test a
start without any options is enough. In order to be able to
perform the work, however the program has to be started as root
or with "<i>sudo</i>"-privileges [8]:</p>
<pre class="code">
neo5k@proteus> sudo /usr/local/sbin/darkstat
We trust you have received the usual lecture from the local System Administrator.
It usually boils down to these two things:
#1) Respect the privacy of others.
#2) Think before you type.
Password:
</pre>
<p>After the authorized user has entered his password,
"<i>darkstat</i>" starts and prints various status
messages:</p>
<pre class="code">
darkstat v2.6 using libpcap v2.4 (i686-pc-linux-gnu)
Firing up threads...
Sniffing on device eth0, local IP is 192.168.1.1
DNS: Thread is awake.
WWW: Thread is awake and awaiting connections.
WWW: You are using the English language version.
GRAPH: Starting at 8 secs, 51 mins, 22hrs, 30 days.
Can't load db from darkstat.db, starting from scratch.
ACCT: Capturing traffic...
Point your browser at http://localhost:666/ to see the stats.
</pre>
<p>Since the test was successful and the output is
self-describing, we can look at the possible start
parameters.</p>
<A NAME="346lfindex3"> </A>
<H2>Starting options</H2>
<p>As previously mentioned, "<i>darkstat</i>" provides several
options, which can be simply be provided
during the startup. Those parameters are:</p>
<p>With option "<i>-i</i>" you can specify which interface is
monitored.</p>
<p class="code">darkstat -i eth1</p>
<p>Started without special parameters, "<i>darkstat</i>" opens
the privileged port 666. You can prevent this habit, when you
start it with parameter "<i>-p</i>":</p>
<p class="code">darkstat -p 8080</p>
<p>In order to bind a certain port to a specific interface, you
can use the option "<i>-b</i>". In the following example to the
local loopback address:</p>
<p class="code">darkstat -b 127.0.0.1</p>
<p>Persistent DNS-Resolution can be prevented by the parameter
"<i>-n</i>". This may be good for people without a
flatrate or a dedicated line.</p>
<p class="code">darkstat -n</p>
<p>Use option "<i>-P</i>" to prevent "<i>darkstat</i>" from
putting the interface into "<i>promiscuous mode</i>". However,
this is not recommendable, because "<i>darkstat</i>" only
captures and analyzes the packets, which are addressed to the
MAC of the monitored network interface. All other packages are
rejected.</p>
<p class="code">darkstat -P</p>
<p>Parameter "<i>-l</i>" activates correctly
"<i>SNAT</i>"-behavior in the local network. "<i>SNAT</i>"
stands for "<i>Source Network Address Translation</i>" and
means that your router masks the local IP address of the client
with its own public. Thus he sends the inquiry representatively
for the originally inquire client.</p>
<p class="code">darkstat -l 192.168.1.0/255.255.255.0</p>
<p>With parameter "<i>-e</i>" you can perform a packet filter
expression.</p>
<p class="code">darkstat -e "port not 22"</p>
<p>From version 2.5 upwards you can detach "<i>darkstat</i>"
from the starting terminal. Thus it works like a daemon.</p>
<p class="code">darkstat --detach</p>
<p>Via parameter "<i>-d</i>" you can specify the directory
where "<i>darkstat</i>" creates its database.</p>
<p class="code">darkstat -d /directory</p>
<p>Option "<i>-v</i>" activates the "<i>verbose mode</i>":</p>
<p class="code">darkstat -v</p>
<p>If you are interested in the version number of
"<i>darkstat</i>" or its full usage and syntax, try parameter
"<i>-h</i>".</p>
<p class="code">darkstat -h</p>
<A NAME="346lfindex4"> </A>
<H2>Handling</H2>
<p>After the first start of "<i>darkstat</i>" you can point
your browser to "<i>http://localhost:666/</i>", which is the
default. Now you can look at a short summary of the
statistics and a few graphs generated since program start:</p>
<center>
<img src="../../common/images2/article346/darkstat-main.png"
alt="darkstat main" border="1" hspace="10" width="479"
height="489"><br>
<i>Illustration 1: darkstat main</i>
</center>
<p>At the "<i>hosts</i>" site you can see all the
machines which take part in the communication. These can be
arranged by the caused traffic or their particular IP
address. By this possibility you can detect the machines, which
have produced the highest traffic in the local network, very
fast. Thereby the responsible system administrator has a
chance to get to the bottom of a problem. For example, in the
following screen shot this would be the client with the local
IP address "<i>192.168.1.203</i>".</p>
<center>
<p><img src=
"../../common/images2/article346/darkstat-hosts.png" alt=
"darkstat hosts" border="1" hspace="10" width="599" height=
"641"><br>
<i>Illustration 2: darkstat hosts</i></p>
</center>
<p>In illustration 3 you can see the port numbers which are
used by server and client applications. You can immediately
recognize the port numbers which are used by the following
daemons: <i>21 (FTP)</i>, <i>22 (SSH)</i>, <i>139 (Samba)</i>,
<i>631 (CUPS)</i>, <i>666 (darkstat)</i>, <i>3128 (Squid)</i>.
However, the two services "<i>dhcpd</i>" and "<i>dnsmasq</i>"
aren't visible, because these services communicate via "<i>UDP</i>".
All other ports larger than 1024 are not
privileged and were used by client applications for
communication. The proxy server "<i>squid</i>" represents a
exception, because it uses the port 3128 as default
setting. You can view a maintained list of all port numbers on
IANA [9], which is responsible for these. Alternatively you can
look into the file "<i>/etc/services</i>".
</p>
<center>
<p><img src=
"../../common/images2/article346/darkstat-ports.png" alt=
"darkstat ports" border="1" hspace="10" width="482" height=
"628"><br>
<i>Illustration 3: darkstat ports</i></p>
</center>
<p>In the following picture you can see the protocols
"<i>ICMP</i>", "<i>TCP</i>" and "<i>UDP</i>" for the file
transmission, which were involved in the communication event.
If someone is interested in these protocols, he will find good
introductions in the following RFCs on [10], [11] and [12].</p>
<center>
<p><img src=
"../../common/images2/article346/darkstat-protos.png" alt=
"darkstat protocols" border="1" hspace="10" width="523"
height="182"><br>
<i>Illustration 4: darkstat protocols</i></p>
</center>
<p>The last screen shot shows a summary of the collected time
periods as graphs:</p>
<center>
<p><img src=
"../../common/images2/article346/darkstat-graphs.png" alt=
"darkstat graphs" border="1" hspace="10" width="599" height=
"584"><br>
<i>Illustration 5: darkstat graphs</i></p>
</center>
<A NAME="346lfindex5"> </A>
<H2>Future prospects</H2>
<p>The version 2.6 of "<i>darkstat</i>" about which we
discussed here, is unfortunately dependent on "<i>pthreads</i>".
This causes problems on other platforms (e.g. NetBSD).
For this reason the program author Emil Mikulic decided to
not develop the current version 2.x any further and
works instead already on 3.x.</p>
<p>In the new version things are being implemented like
capturing packets from multiple interfaces simultaneously, a
config file parser, an optically improved output for diagrams
(comparably with the RRDtool [13]), a customizable CSS-file,
admin login and editing of the database through the web interface
etc.</p>
<A NAME="346lfindex6"> </A>
<H2>Conclusion</H2>
<p>"<i>darkstat</i>" is a very stable and fast network
monitoring tool, which exclusively serves its targeted
purpose - to analyse traffic. Furthermore it works without
any problems, stands in constant development and will have many
new and interesting features in the upcoming version. So long I
wish much success with the search for "traffic sinners" in your
local networks.</p>
<A NAME="346lfindex7"> </A>
<H2>Links</H2>
<p>[1] <a href="http://purl.org/net/darkstat" target=
"_top">http://purl.org/net/darkstat</a> [Home of darkstat]<br>
[2] <a href="http://www.ntop.org/" target=
"_top">http://www.ntop.org/</a> [Home of ntop]<br>
[3] <a href=
"http://dmr.ath.cx/net/darkstat/darkstat-2.6.tar.gz" target=
"_top">http://dmr.ath.cx/net/darkstat/darkstat-2.6.tar.gz</a>
[Download]<br>
[4] <a href=
"http://yallara.cs.rmit.edu.au/~emikulic/_/darkstat-2.6.tar.gz"
target=
"_top">http://yallara.cs.rmit.edu.au/~emikulic/_/darkstat-2.6.tar.gz</a>
[Download Mirror #1]<br>
[5] <a href=
"http://neo5k.de/downloads/files/darkstat-2.6.tar.gz" target=
"_top">http://neo5k.de/downloads/files/darkstat-2.6.tar.gz</a>
[Download Mirror #2]<br>
[6] <a href=
"http://ftp.debian.org/debian/pool/main/d/darkstat/" target=
"_top">http://ftp.debian.org/debian/pool/main/d/darkstat/</a>
[Debian Packages]<br>
[7] <a href="http://www.tcpdump.org/" target=
"_top">http://www.tcpdump.org/</a> [Home of libpcap]<br>
[8] <a href="http://www.courtesan.com/sudo/" target=
"_top">http://www.courtesan.com/sudo/</a> [Home of sudo]<br>
[9] <a href="http://www.iana.org/assignments/port-numbers"
target="_top">http://www.iana.org/assignments/port-numbers</a>
[IANA Port-Numbers]<br>
[10] <a href="ftp://ftp.rfc-editor.org/in-notes/rfc792.txt"
target="_top">ftp://ftp.rfc-editor.org/in-notes/rfc792.txt</a>
[RFC 792 - ICMP]<br>
[11] <a href="ftp://ftp.rfc-editor.org/in-notes/rfc793.txt"
target="_top">ftp://ftp.rfc-editor.org/in-notes/rfc793.txt</a>
[RFC 793 - TCP]<br>
[12] <a href="ftp://ftp.rfc-editor.org/in-notes/rfc768.txt"
target="_top">ftp://ftp.rfc-editor.org/in-notes/rfc768.txt</a>
[RFC 768 - UDP]<br>
[13] <a href=
"http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/" target=
"_top">http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/</a>
[Home of RRDtool]<br>
</p>
<!-- vim: set sw=2 ts=2 et tw=74: -->
<!-- BODY_OF_THE_ARTICLE_STOP -->
<!-- 2pdaIgnoreStart -->
<A NAME="talkback"> </a>
<h2>Talkback form for this article</h2>
Every article has its own talkback page. On this page you can submit a comment or look at comments from other readers:
<center>
<table width="250" border=0><tr><td>
<div class="tbbutton"><A class="nodec" href="http://cgi.linuxfocus.org/cgi-bin/lftalkback?anum=346"> talkback page </a></div>
</td></tr></table>
</center>
<br clear="all">
<HR size="2" noshade>
<table width="250" border=0><tr><td>
<div class="bbutton"><a class="nodec" href="../../index.shtml"><--, LF Home</a></div>
</td><td>
<div class="bbutton"><a class="nodec" href="index.shtml">Go to the index of this issue</a></div>
</td></tr></table>
<br clear="all">
<HR size="2" noshade>
<!-- ARTICLE FOOT -->
<CENTER><TABLE WIDTH="98%" summary="footer">
<TR><TD ALIGN=CENTER BGCOLOR="#bdc6d5" WIDTH="50%">
<A HREF="../../common/lfteam.html">Webpages maintained by the LinuxFocus Editor team</A>
<BR><FONT COLOR="#1111aa"><a href="../../common/copy.html">© Mario M. Knopf</a><br>"some rights reserved" see <a href="../../license/index.shtml">linuxfocus.org/license/</a><br><a href="http://www.linuxfocus.org">http://www.LinuxFocus.org</a></FONT>
</TD>
<TD BGCOLOR="#bdc6d5">
<!-- TRANSLATION INFO -->
<font size=2>Translation information:</font>
<TABLE summary="translators">
<tr><td><font size="2">de --> -- : Mario M. Knopf (<a href="http://www.neo5k.org/"><font size="1">homepage</font></a>)</font></td></tr>
<tr><td><font size="2">de --> en: Mario M. Knopf (<a href="http://www.neo5k.org/"><font size="1">homepage</font></a>)</font></td></tr>
</TABLE>
</TD>
</TR></TABLE></CENTER>
<p><font size=1>2004-10-15, generated by lfparser version 2.50</font></p>
<!-- 2pdaIgnoreStop -->
</BODY>
</HTML>