~/ linuxnetwork.net

Darkstat: Capturing Network Traffic

In the realm of network monitoring and analysis, understanding the traffic flowing through your network is crucial. Darkstat is a lightweight, open-source tool that captures network traffic in real-time and serves usage statistics through a built-in web interface. It provides valuable insights into network activity, helping you identify potential issues, optimize performance, and enhance security. In this blog post, we will delve into the details of Darkstat, its features, installation, configuration, and usage.

Table of Contents#

  1. What is Darkstat?
  2. Features of Darkstat
  3. Installation
    • On Linux
    • On macOS
  4. Configuration
    • Basic Configuration
    • Advanced Configuration
  5. Usage
    • Capturing Traffic
    • Analyzing Traffic
  6. Common Practices
    • Monitoring Network Performance
    • Identifying Security Threats
  7. Best Practices
    • Regularly Update Darkstat
    • Secure the Darkstat Interface
  8. Example Usage
    • Monitoring a Local Network
    • Analyzing Traffic on a Specific Interface
  9. Conclusion
  10. References

What is Darkstat?#

Darkstat is an open-source network traffic analyzer that runs on Unix-like systems. It captures network packets in real-time and provides a web-based interface to visualize and analyze the traffic. Darkstat is designed to be lightweight and efficient, making it suitable for monitoring both small and large networks.

Features of Darkstat#

  • Real-time Monitoring: Darkstat captures network traffic in real-time, allowing you to monitor the network activity as it happens.
  • Web-based Interface: Darkstat provides a web-based interface with an embedded HTTP server and deflate compression. You can access the interface from any web browser on the network.
  • Host Analysis: Darkstat can display information about the hosts involved in the network traffic, including per-host ports.
  • Traffic Statistics: Darkstat provides traffic statistics, including host-level byte totals and traffic graphs.
  • Filtering: Darkstat allows you to filter the network traffic based on various criteria, such as source and destination IP addresses and protocols using BPF (Berkeley Packet Filter) syntax.
  • IPv6 Support: Darkstat supports IPv6 traffic capture and analysis.
  • Asynchronous DNS Resolution: Darkstat performs reverse DNS lookups using a child process, so DNS queries do not block traffic capture.
  • Lightweight and Portable: Darkstat is single-threaded, efficient, and runs on most Unix-like systems including Linux, FreeBSD, OpenBSD, and macOS.

Installation#

On Linux (Debian/Ubuntu-based systems)#

The following instructions apply to Debian/Ubuntu-based Linux distributions:

  1. Update the Package List: 
    sudo apt update
  2. Install Darkstat: 
    sudo apt install darkstat

On Linux (Fedora/RHEL-based systems)#

On Fedora, CentOS Stream, or RHEL-based distributions:

sudo dnf install darkstat

On macOS#

You can install Darkstat using Homebrew, MacPorts, or compile from source:

  1. Using Homebrew: 
    brew install darkstat
  2. Using MacPorts: 
    sudo port install darkstat
  3. Compiling from source: Darkstat requires libpcap to build. Follow the instructions on the Darkstat GitHub repository.

Configuration (Debian/Ubuntu-based systems)#

Basic Configuration#

  1. Edit the Darkstat Configuration File: 
    sudo nano /etc/darkstat/init.cfg
  2. Set the Interface: 
    INTERFACE="-i enp0s3"
    Replace enp0s3 with the name of your network interface. Modern Linux systems use predictable names like enp0s3, ens33, or wlp2s0 instead of the older eth0. List available interfaces with ip link show.
  3. Enable the Service: 
    START_DARKSTAT="yes"
  4. Set the Port: 
    PORT="-p 666"
    You can change the port number if needed.
  5. Set Bind IP (to access from network): 
    BINDIP="-b 0.0.0.0"
    This allows access to the web interface from other devices on the network. Use -b 127.0.0.1 to restrict access to the local machine only.
  6. Save and Exit: Press Ctrl + X, then Y, and finally Enter to save and exit the configuration file.

Advanced Configuration#

  1. Set the Filter: Add the filter to the FILTER variable: 
    FILTER="-f tcp port 80 or tcp port 443"
    This filter will only capture traffic on ports 80 (HTTP) and 443 (HTTPS). Darkstat uses standard BPF (Berkeley Packet Filter) syntax for filters.

Usage (Debian/Ubuntu-based systems)#

Capturing Traffic#

  1. Start Darkstat Service: Use one of the following commands to start the Darkstat service: 
    sudo systemctl start darkstat
    or 
    sudo service darkstat start
  2. Enable Darkstat to Start on Boot (optional): 
    sudo systemctl enable darkstat
  3. Access the Darkstat Interface: Open a web browser and navigate to http://<your_server_ip>:666.

Analyzing Traffic#

  1. View the Hosts: Click on the Hosts page to view the list of hosts involved in the network traffic.
  2. View the Graphs: Click on the Graphs page to view network traffic graphs.
  3. View Ports per Host: Click on an individual host to see which ports are in use.

Common Practices#

Monitoring Network Performance#

  1. Track Bandwidth Usage: Use Darkstat to monitor the bandwidth usage of your network. This can help you identify any bandwidth-hungry applications or users.
  2. Identify Network Bottlenecks: Analyze the network traffic to identify any network bottlenecks. This can help you optimize the performance of your network.

Identifying Security Threats#

  1. Monitor for Suspicious Activity: Use Darkstat to monitor for unusual traffic volume anomalies that may indicate potential issues such as unexpected data exfiltration, unauthorized access attempts, or compromised hosts.

Best Practices#

Regularly Update Darkstat#

  1. Update Darkstat: Regularly update Darkstat to ensure that you have the latest security patches and bug fixes.
  2. Update the Operating System: Keep your operating system up-to-date to ensure that you have the latest security patches and bug fixes.

Secure the Darkstat Interface#

  1. Use HTTPS via Reverse Proxy: Darkstat does not natively support HTTPS. Use a reverse proxy (such as Nginx or Apache) to encrypt the traffic between the server and the web browser.
  2. Restrict Access: Restrict access to the Darkstat interface to only authorized users. Darkstat has no built-in authentication, so access control must be handled at the network or reverse proxy level. Use BINDIP="-b 127.0.0.1" to limit access to the local machine, or configure firewall rules to allow only trusted IP addresses.

Example Usage (Debian/Ubuntu-based systems)#

Monitoring a Local Network#

  1. Start Darkstat Service: 
    sudo systemctl start darkstat
  2. Access the Darkstat Interface: Open a web browser and navigate to http://<your_server_ip>:666.
  3. View the Hosts: Click on the Hosts page to view the list of hosts on your local network.
  4. View the Graphs: Click on the Graphs page to view traffic graphs for your local network.

Analyzing Traffic on a Specific Interface#

  1. Configure the Interface in /etc/darkstat/init.cfg: Set INTERFACE="-i enp0s3" (replace enp0s3 with your desired interface).
  2. Restart Darkstat Service: 
    sudo systemctl restart darkstat
  3. Access the Darkstat Interface: Open a web browser and navigate to http://<your_server_ip>:666.
  4. View the Hosts and Graphs: Use the Hosts and Graphs pages to analyze traffic on the specific interface.

Conclusion#

Darkstat is a powerful tool for capturing and analyzing network traffic. It provides valuable insights into network activity, helping you identify potential issues, optimize performance, and enhance security. By following the installation, configuration, and usage instructions provided in this blog post, you can start using Darkstat to monitor and analyze your network traffic. For more advanced network monitoring needs, consider tools like ntop or vnstat as complementary or alternative solutions.

References#

2026-05