darkstat

darkstat is a network traffic analyzer designed to monitor and visualize network activity efficiently. It operates as a lightweight packet sniffer, capturing data and presenting it through a web interface accessible via a browser. Key features include breakdowns of IP traffic by machines, ports, and protocols, as well as time-based graphical representations of global input and output traffic over various intervals such as the last minute, hourly, daily, and monthly.

Use cases for darkstat include real-time network monitoring, troubleshooting connectivity issues, and analyzing traffic patterns in environments where resource efficiency is critical. It is particularly suited for scenarios requiring a small memory footprint and high stability, making it a preferred alternative to heavier tools like ntop.

The tool integrates seamlessly into Kali Linux environments for cybersecurity tasks, such as reconnaissance and traffic inspection during penetration testing.

darkstat uses libpcap (version 1.10.6 with 64-bit time_t and TPACKET_V3 support) to capture network packets on specified interfaces or from capture files. It processes the packets in the background, aggregating statistics on IP traffic by machines, ports, and protocols. These statistics are served via an embedded web server, typically on a configurable port and bind address, allowing browser-based access to real-time and historical graphical data including last-minute, hourly, daily, and monthly input/output charts.