1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
|
v3.0.715 (January 2012)
- Compatibility fixes for Hurd and Solaris.
- Use link-time optimization and automake-like silent rules.
- Support systems without ifaddrs.h again.
- Continuing fixes for IPv6 support.
- Only update lastseen time for sender, not recipient.
- Implement --local-only: accounting for hosts on the local net.
- Make failure to bind() a socket non-fatal.
- Make failure to get local IP non-fatal.
- Fall back to gethostbyaddr() if getnameinfo() fails.
- Fix detection of IPv4 multicast addresses.
- Fix decoding on OpenBSD DLT_NULL interfaces (e.g. gif(4))
v3.0.714 (June 2011)
- IPv6 support! Big ups to Mats Erik Andersson who did most
of this work!
- Allow sort on last-seen, thanks to Dirk Koopman.
- Support multiple bind addresses.
- Add --disable-debug configure flag, thanks to Malte S. Stretz.
- Make it possible to save the DB without resetting it (SIGUSR2).
- Web: Use relative URLs, so darkstat works properly behind mod_proxy,
thanks to Malte S. Stretz.
v3.0.713 (March 2010)
- Don't require --verbose for pcap_stats.
- Survive interface going down on Linux.
- Support DLT_RAW, implemented by Anton S. Ustyuzhanin.
- Skip accounting for hosts or ports if their max is set to zero.
- Implement --hexdump for troubleshooting.
- Web: Implement --no-lastseen
- Implement --snaplen manual override.
- Fix snaplen problem on recent (1-2 years?) Linux kernels.
- Implement --syslog
- Implement --wait as a NetworkManager workaround.
(there were no releases made in 2009)
v3.0.712 (November 2008)
- Web: Add --no-macs option to hide mac addresses.
Thanks Dennis!
- Web: Make tables prettier.
- Host detail view now triggers a DNS lookup.
- Manpage tweaks, also move from section 1 to section 8.
- Track and show how long ago a host was last seen.
Suggested by: Prof A Olowofoyeku (The African Chief)
- Show pcap_stats (like number of packets dropped) in the web
interface and also upon exit.
v3.0.711 (August 2008)
- Split --debug into --verbose and --no-daemon
- Include launchd config and instructions for running darkstat
on Mac OS X. Contributed by Damien Clauzel.
- Implement PPPoE decoding on ethernet iface. (--pppoe)
- Web: Add automatic reload button. Thanks Dennis!
- Web: Add a graph legend with min/avg/max.
- Web: Remove hashtable stats pages.
v3.0.708 (May 2008)
- Implement limiting of number of ports tracked per host,
configurable on the commandline (--ports-max)
- Optionally don't track high ports (--highest-port)
Thanks Dennis!
- Fix rare use-after-free resulting from hosts table reduction.
- Make hosts limit configurable (--hosts-max)
- Option to read from capfile as alternative to live capture
(really only useful for development, benchmarking)
- Add the sniffed interface name to HTML reports.
Thanks Chris!
v3.0.707 (Sep 2007)
- Fix silly bug in formatting hex.
- Check for pcap.h in include/pcap/ for old RedHat-a-likes.
- New commandline parser.
- To stay in foreground, pass --debug instead of -d.
- We can now reset all statistics at runtime (send SIGUSR1)
- Make chroot dir configurable on cmdline (--chroot)
- Make privdrop user configurable on cmdline (--user)
- Implement daylog (brings back a v2 feature)
- Import and export hosts and graphs, this brings back a fairly
major v2 feature. Big ups to Ben for doing a lot of the
design and implementation of this feature!
Note that the v3 database format is, by design, incompatible
with the v2 format.
- Report average KB/s in and out on graphs.
Thanks to Damian Lozinski for suggestion and first cut at the
implementation.
- Fix graph rotation when the delay between rotations is big
enough to clear an entire graph.
- Make ip_proto 8 bits wide, to match the IP header.
- Implement pidfile functionality for people who prefer to
handle daemons in this manner.
v3.0.619 (Apr 2007)
- Decode DLT_PPP and DLT_PPP_SERIAL on NetBSD,
patch courtesy of Bartosz Kuzma.
- Don't use pcap_setnonblock(), with help from Colin Phipps.
- Reduce the number of syscalls made.
- Answer FAQ about graph axes / labels / scale.
- Fix build on OpenBSD (thanks Chris!) and Solaris.
- Commandline arg (-n) to disable promiscuous mode when
sniffing, thanks to Chris Kuethe for the implementation.
- Commandline arg (-r) to disable DNS resolver.
- Track and report per-host last seen MAC address.
- Move FAQ into manpage.
- Implement display of start time and running time.
- Web: implement sorting the hosts table by in/out/total.
- Web: implement paging through the hosts table.
- Web: implement full view of hosts table.
- Don't die if the capture interface loses its IP address.
- Make daemonize (previously -d) the default, and make -D the
argument to suppress it.
- Commandline arg (-l) to graph traffic entering/leaving the
local network as opposed to just the local IP. v2 had this.
- Allow configure-time override of CHROOT_DIR and PRIVDROP_USER.
- Web: new color scheme.
v3.0.540 (Aug 2006)
- Fix build against old libpcap (thanks Claudio)
- Fix build on AIX (thanks Andreas)
- Fix build warnings on NetBSD (thanks Bartosz)
- Deny writes to BPF socket (thanks Can)
- Reverse-resolve IPs less aggressively.
- Free up the DNS queue as we process it.
- Fix dns_reply silliness.
- Web: tweak the look of the top bar.
- Web: update total packets and bytes as part of graph update.
- Decode DLT_LINUX_SLL (ippp0 on Linux),
patch courtesy of Ingo Bressler
v3.0.524 (Jul 2006)
- Fix build on NetBSD.
- Fix shutdown on Linux.
- Performance improvements.
- Free the mallocs.
- Work around BPF being immediate on Linux.
This improves performance.
- Drop privileges when we don't need them. Chroot. Generally
be more paranoid. Thanks to Chris Kuethe for patches and
inspiration.
- Daemonize. (run in the background)
- Graphs: Make the entire bar have the same label (instead of
different labels for in/out), add thousands separators for
legibility, include the position/index (i.e. day 22)
- Instead of reducing the hosts_db based on time, do it based on
its size.
- Implement somewhat better handling of time moving backwards -
we assume that real time is monotonic and just renumber the
graph bars. (time is hard)
- Greatly improve IPC with the DNS child, make it more efficient
and much more robust.
- Decode DLT_PPP_ETHER (pppoe0 on OpenBSD), patch courtesy of
Claudio Leite.
v3.0.471 (Jun 2006)
First public release of darkstat 3. Almost a complete rewrite
since v2.6. Architecture much improved, better portability and
stability. Approximate feature parity with v2, missing
loading/saving DB.
v2.6 (Nov 2003)
End of the line for darkstat 2
|
