darkstat
darkstat copied to clipboard
[WIP] openbsd: stats from pf
While trying to monitor traffic on OpenBSD router box with darkstat
, I observed that darkstat
cannot account traffic accurately when there's a large traffic, because of packet pcap
packet drop. For example, openbsd pcap
drops about 1/3 packets on ~1gbps which makes accounting rather inaccurate.
To overcome the issue, I tried to capture number of bytes/packets from pf
instead of pcap
. It seems working on my environment and I wanted share the patch with others :)
Notes
-
cache.c
andpf.c
are largely borrowed from openbsd source tree. - pf should be enabled to make it work.
- It requires to set
-l
flag to work property, as it cannot detect local interface address. - It does not handle ipv6 states.