
darkstat: a network traffic analyzer
Copyright (c) 2001-2003, Emil Mikulic.

This software is subject to the terms of the
GNU General Public License (GPL) - see the accompanying
'COPYING' file.

--- Quickstart ---

	./configure
	make
	su
	make install
	darkstat

To specify which interface to monitor:
	darkstat -i eth1

To specify a different web port:
	darkstat -p 8080

To bind the web port to a different interface:
	darkstat -b 127.0.0.1

To see what's going on (more verbosely):
	darkstat -v

To prevent persistent DNS resolution (like for people dialing on demand):
	darkstat -n

To prevent darkstat from putting the interface into promiscuous mode:
	darkstat -P

To pass a packet filter expression (refer to libpcap/tcpdump):
	darkstat -e "port not 22"

To get correct stats with a 2.4.x Linux kernel and SNAT:
(assuming your local network is 192.168.0.x)
	darkstat -l 192.168.0.0/255.255.255.0

To monitor the external interface (eth0) while logging all intercepted
HTTP requests on the local interface (eth1):
	darkstat -i eth0 --spylog eth1

For full usage:
	darkstat -h

My preferred way of running in the background:
	nohup darkstat &

From v2.5 onwards you can:
	darkstat --detach
Note that this hasn't been extensively tested.

bash script to wait for darkstat to die cleanly:
	kill `cat darkstat.pid`
	while [ -e darkstat.pid ]
	do
		echo waiting for darkstat to shut down...
		sleep 1
	done
