darkstat icon indicating copy to clipboard operation
darkstat copied to clipboard

[WIP] openbsd: stats from pf

Open yjh0502 opened this issue 2 years ago • 0 comments

While trying to monitor traffic on OpenBSD router box with darkstat, I observed that darkstat cannot account traffic accurately when there's a large traffic, because of packet pcap packet drop. For example, openbsd pcap drops about 1/3 packets on ~1gbps which makes accounting rather inaccurate. To overcome the issue, I tried to capture number of bytes/packets from pf instead of pcap. It seems working on my environment and I wanted share the patch with others :)

Notes

  • cache.c and pf.c are largely borrowed from openbsd source tree.
  • pf should be enabled to make it work.
  • It requires to set -l flag to work property, as it cannot detect local interface address.
  • It does not handle ipv6 states.

yjh0502 avatar Jun 03 '22 04:06 yjh0502