Captures network traffic, calculates statistics about usage, and serves reports over HTTP.

Features:

  • Traffic graphs, reports per host, shows ports for each host.
  • Embedded web-server with deflate compression.
  • Asynchronous reverse DNS resolution using a child process.
  • Small. Portable. Single-threaded. Efficient.
  • Supports IPv6.

Screenshots: (click)

graphs hosts ports

Code:

Quickstart:

# ./configure
# make

Once built, this is all it takes to get darkstat running: 

# darkstat -i eth0

Although it's possible to configure / complicate things further, once out of the box, darkstat will just work without much trouble on your part.

darkstat should build and run on any modern UNIX system that has libpcap. It has been reported to build on:

On my FreeBSD router, ppp takes an order of magnitude more CPU time than darkstat. If your system can keep up with PPPoE, you should have no trouble running darkstat.