How to install Darkstat in Ubuntu
To install Darkstat in Ubuntu
Darkstat is a web based tool used to analyze the network traffic. It can also generate the traffic reports for hosts and identify the ports detail. Installation of Darkstat in Ubuntu is explained in this manual.
Installation of Darkstat
First install the required packages for Darkstat with the following command.
user1@linuxhelp:~$ sudo apt-get install libpcap-dev
[sudo] password for user1:
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed:
libpcap0.8-dev
The following NEW packages will be installed:
libpcap-dev libpcap0.8-dev
0 upgraded, 2 newly installed, 0 to remove and 361 not upgraded.
Need to get 216 kB of archives.
After this operation, 734 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 http://in.archive.ubuntu.com/ubuntu xenial/main amd64 libpcap0.8-dev amd64 1.7.4-2 [212 kB]
Get:2 http://in.archive.ubuntu.com/ubuntu xenial/main amd64 libpcap-dev all 1.7.4-2 [3,394 B]
.
.
Done!
Now run the below comnmand to install darkstat application.
user1@linuxhelp:~$ sudo apt-get install darkstat
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
darkstat
0 upgraded, 1 newly installed, 0 to remove and 361 not upgraded.
Need to get 59.7 kB of archives.
After this operation, 169 kB of additional disk space will be used.
Get:1 http://in.archive.ubuntu.com/ubuntu xenial/universe amd64 darkstat amd64 3.0.719-1 [59.7 kB]
.
.
Done!
Next you need to configure the darkstat application.
user1@linuxhelp:~$ sudo vim /etc/darkstat/init.cfg
Here you should change the start parameter as ' yes' and enter the interface name. Next remove the leading # symbol and then finally change the IP address & location.
After successfully configured, run the below command to restart the darkstat package.
user1@linuxhelp:~$ sudo /etc/init.d/darkstat restart
[ ok ] Restarting darkstat (via systemctl): darkstat.service.
Open the browser and enter the machine IP address in the URL. The web based graphical interface of Darkstat will display as shown below. Now you can able to analyze your network traffic.
Click on Graphs tab to change the automatic reload in ON mode.
Click on Hosts tab to view the hosts monitored by the Darkstat.
sudo service darkstat start
At this point the darkstat service will be running and collecting data. Now all you have to do is point a web browser to http://IP_OF_SERVER:666 (IP_OF_SERVER is the actual IP address of the server running darkstat) and start viewing your networking graphs.
When you log into the darkstat graphs, you'll see a static graph (Figure A). If you scroll down to the bottom of the page, you can click to enable auto reload so the graphs automatically update.
START_DARKSTAT=no
to
START_DARKSTAT=yes
Next, you'll need to edit the line:
INTERFACE="-i XXX
so that it uses the networking interface on the machine (XXX is the name of the interface, such as eth0).
After that, uncomment out (remove the leading # character) the following section:
DIR="/var/lib/darkstat"
PORT="-p 666"
BINDIP="-b 127.0.0.1"
LOCAL="-l 192.168.1.0/255.255.255.0"
You also need to change the LOCAL section (above) to reflect your networking address scheme. After you make those changes, save and close the file.
Darkstat does an outstanding job of keeping you in the know as to what network traffic is hitting your server; plus, you'd be hard-pressed to find a simpler network monitoring tool for a Linux server. Give it a try, and see if it doesn't make your Linux server admin job easier.