wiki:noc2018/agenda/PfDarkStat

Darkstat

Darkstat is a network statistics gatherer. It's a packet sniffer that runs as a background process and gathers all sorts of statistics about network usage, and serves them over HTTP.

Step 1:

The first thing you'll need to do is install darkstat package in pfSense. Goto Package Manager from drop down System menu

Select Available Packages and search for darkstat. Then locate the darkstat package and click the + symbol next to it and confirm the setup to begin the installation. The installation process normally takes a few minutes to complete, make sure you do not leave the package installer page while it is installing.

Step 2:

Once the installation completes goto darkstat Settings on Diagnostics drop down menu.

Configure following to enable darkstat:

  • Enable darkstat: check the tick
  • Capture Interfaces: LAN
  • Web Interface Port: 666
  • Local Network Traffic: check the tick
  • Local Network: LAN

and Save

Step 3:

Browse to http://<pfsense-ip>:666

Analysis

Graphs

You will be presented with graphs of data count with time intervals of last 60 seconds, last 60 minutes, last 24 hours and last 31 days.

To get automatic updates on graphs toggle the reload button on the bottom.

Hosts

You will be present with a table of IP addresses, Hostnames, Mac Addresses, byte counts and last seen time where you can use sorting to find minimum and maximum values.

Last modified 12 months ago Last modified on Nov 29, 2018, 4:40:19 PM