OpenBSD Journal

net/darkstat

Contributed by mbalmer on from the bloodhound dept.

Darkstat, which has recently been added to our ports tree, is a packet sniffer which runs as a background process on a cable/DSL router, gathers all sorts of useless but interesting statistics, and serves them over HTTP.

Some of Darkstats features are:

  • Traffic graphs.
  • Tracks traffic per host.
  • Tracks traffic per TCP and UDP port for each host.
  • Embedded web-server with deflate compression.
  • Asynchronous reverse DNS resolution using a child process.
  • Small. Portable. Single-threaded. Efficient.

Almost a complete re-write, darkstat 3 is the latest version of darkstat. It is considered to be "in testing" and still has a lot of debugging code and verbose output, but is nevertheless considered much better code than the dated darkstat 2.

See http://dmr.ath.cx/net/darkstat/ for more details.

(Comments are closed)

Comments

  1. By Anonymous Coward (62.225.37.69) on

    nice...

  2. By Antonios Anastasiadis (147.102.223.110) on

    sweet.
    I really like that recent trend in posting various new/updated ports in undeadly. Keep up!

  3. By Anonymous Coward (203.113.233.137) on

    useless stats?

    Comments

    1. By mike m (72.128.112.46) on

      > useless stats?


      Comment above taken directly from the darkstat web site. Check it out when you get a chance!

  4. By Anonymous Coward (24.126.56.226) on

    Seems like a neat tool, especially the feature that allows you to monitor traffic by host. Seems like something I'd like to try out at work just to see who the bandwidth hogs are.

    Although, this went into ports-current right? Therefore, if you're running OpenBSD 3.9 you only get OpenBSD 3.9 version of the ports tree or you might run ports-stable (the security branch of the ports tree for 3.9). I guess what I'm trying to get at is, "Doesn't OpenBSD not support running ports-current on an OpenBSD release?" Don't I need to be running OpenBSD current in order to use ports-current? I just wanted some clarity on this. All I have ever read in the OpenBSD documentation was "DON'T RUN PORTS CURRENT ON RELEASE", so I never have.

    Anyway, it's cool that neat and interesting ports are being added to the OpenBSD ports tree.

    Comments

    1. By Anonymous Coward (202.6.138.34) on

      >Don't I need to be running OpenBSD current in order to use ports-current?

      Yes.

      However, if you try running ports-current on OpenBSD-stable most things will work anyway - just don't ask for help if you have problems.

      Comments

      1. By Anonymous Coward (80.60.145.215) on

        > >Don't I need to be running OpenBSD current in order to use ports-current?
        >
        > Yes.
        >
        > However, if you try running ports-current on OpenBSD-stable most things will work anyway - just don't ask for help if you have problems.
        It's like running before you can walk. It may work, but most of the times, you just fall.

      2. By Marc Balmer (213.189.137.178) mbalmer@openbsd.org on

        > >Don't I need to be running OpenBSD current in order to use ports-current?
        >
        > Yes.
        >
        > However, if you try running ports-current on OpenBSD-stable most things will work anyway - just don't ask for help if you have problems.

        This is bad advice. All the port development happens on -current systems. So, yes, to use -current ports you need to run a -current system. Using -current ports on -release or -stable systems can lead to all kinds of subtle problems.

        And a last request: If you run -current ports on non-current systems, please don't ask any questions or even ask for help on our mailing lists... You decided to dance rock-n-roll on a thin layer of ice, so you better learn to swim...

        Comments

        1. By Anonymous Coward (84.188.213.185) on

          At least if you`ve to scan multiple networks you`ve to use Current Ports (at least for nmap) because the nmap-Version in STABLE is buggy.

          Fyodor fixed many stuff (mem-leaks) but the Port remained at 3.95...
          So using "stable" is not always useable.. ;)

          So curreent Ports? if you`re forced to use them: Yes... well.. use them. ;)

          Comments

          1. By Anonymous Coward (69.70.207.240) on

            > At least if you`ve to scan multiple networks you`ve to use Current Ports (at least for nmap) because the nmap-Version in STABLE is buggy.
            >
            > Fyodor fixed many stuff (mem-leaks) but the Port remained at 3.95...
            > So using "stable" is not always useable.. ;)
            >
            > So curreent Ports? if you`re forced to use them: Yes... well.. use them. ;)

            Why not create a /usr/ports-current or something like that for such situations, if needed?

          2. By Anonymous Coward (202.6.138.34) on

            > At least if you`ve to scan multiple networks you`ve to use Current Ports (at least for nmap) because the nmap-Version in STABLE is buggy.
            >
            > Fyodor fixed many stuff (mem-leaks) but the Port remained at 3.95...
            > So using "stable" is not always useable.. ;)
            >
            > So curreent Ports? if you`re forced to use them: Yes... well.. use them. ;)

            In my experience, using one or two isolated -current ports on an otherwise -stable system has been fine. I would not like to try this if the port had many -current dependencies. Backporting a -current port to stable usually only requires minor Makefile changes and checking diffs between -stable and -current will give you an indication of whether its likely to work or not.

            If you can afford to waste your own time, and aren't going to bother anyone else with it on misc@, etc. then go ahead and have some fun.

            Comments

            1. By Anonymous Coward (211.28.153.172) on

              > In my experience, using one or two isolated -current ports on an otherwise -stable system has been fine.

              Code is just code. Most of the 3rd-party apps in /usr/ports don't have any requirements specific to OpenBSD-current - they're written to run across a whole spectrum of UNIX-a-like systems.

              What -can- depend on OpenBSD-current is that the ports system uses the package tools, and the package tools are part of the OpenBSD src tree, not the OpenBSD ports tree. So if ports-current expects package tools that are newer than what you have on your system, you could have problems, not with the actual ports applications, but with the way the ports system installs them.

              Or, at least, this is what I noticed in my use of OpenBSD (and ports) in the past.

        2. By Anonymous Coward (87.78.94.152) on

          Running -current isnt a problem anyway.

          If one cannot have unscheduled downtime:
          Get a snap and follow the cvs-changes for a day or two.
          Look out for Theo ripping heads off. If you dont see any rolling or no relevant showstopper-fixing commits, update with that snap.
          rinse repeat.

      3. By phessler (64.173.147.26) on

        > However, if you try running ports-current on OpenBSD-stable most things will work anyway - just don't ask for help if you have problems.

        Wrong. Somethings *might* work. If you are lucky. And sacraficed a chicken or a linux developer. -current ports on not -current source will break stuff. There are dependancies between ports and the source tree, and they can be quite subtle. Don't risk it.

        I agree with not asking for help if you have problems. Its like asking the doctor 'why does it hurt when I stab myself in the foot'. Just because you 'can' do something doesn't mean you 'should'.

        Comments

        1. By Anonymous Coward (69.70.207.240) on

          > > However, if you try running ports-current on OpenBSD-stable most things will work anyway - just don't ask for help if you have problems.
          >
          > Wrong. Somethings *might* work. If you are lucky. And sacraficed a chicken or a linux developer. -current ports on not -current source will break stuff. There are dependancies between ports and the source tree, and they can be quite subtle. Don't risk it.
          >
          > I agree with not asking for help if you have problems. Its like asking the doctor 'why does it hurt when I stab myself in the foot'. Just because you 'can' do something doesn't mean you 'should'.

          -- And sacraficed a chicken or a linux developer. --

          That's funny!

  5. By Paladdin (213.97.233.52) on

    For the sake of curiosity, although not recommended, yesterday I downloaded the net/darkstats port and compiled it in OpenBSD 3.9 (release) to find that it Just Worked(TM).

    -f "filter" option, with a sintax similar to tcpdump, is pretty useful.

    String and mem manipulation not up to OpenBSD standards, but nice app to play at home :)

    Comments

    1. By Anonymous Coward (211.28.153.172) on

      > String and mem manipulation not up to OpenBSD standards, but nice app to play at home :)

      Chris Kuethe has contributed a lot of security improvements that will be in the next release (and are currently available as patches from http://dmr.ath.cx/net/darkstat/)

      Comments

      1. By Anonymous Coward (131.170.90.3) on

        Aforementioned patches are gone, rolled into the 3.0.524 release.

  6. By mk (217.197.149.135) on

    Seems nice, nevertheless is it possible to have also separate graphs for each IP address? I heard that also pfstat will support labels, somebody knows anything new?

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]