darkstat

The darkstat package in libreCMC is useful as a low resource method of tracking overall bandwidth usage up through the last month. darkstat tracks stats of your network usage on an interface, and displays them as 1 minute, 1 hour, 1 day, and 1 month graphs:

It doesn’t seem to use much processing resources, about 1% CPU load on my 300Mhz GL-AR300M router. The LuCi interface does have a nice bandwidth graph display built in, but it only displays a 3 minute window. So, this seems like a useful tool, especially as it does not require much CPU resources and has a package size of only about 40KB.

In theory, you could use this for analysis and logging of traffic, because of the hosts tracking and logging functionality.

If you click on a host record you get port and protocol information.

This is a tricky, though, as darkstat doesn’t index the host information by time. So, you are just getting running totals from since darkstat started. However, you can send POSIX signals to the daemon which will cause it to clear out its host memory tables and/or log the data to a file. The logging though requires some tweaking to the darkstat command line arguments. In libreCMC, the command line arguments are translated to a config file at /etc/config/darkstat. It seems, though, that the config file does not support the logging options, so you would find yourself tweaking the init.d file. And then you would need scripts to send the signals and delete old logs and so forth. Also, you probably would want to tweak the config file some more to filter out traffic on just the local network, or change over to the wan interface. In summary, you could log lots of useful host data, but you’ll have to do some configuration and scripting to get there.