Skip to content

Conversation

@yjh0502
Copy link

@yjh0502 yjh0502 commented Jun 3, 2022

While trying to monitor traffic on OpenBSD router box with darkstat, I observed that darkstat cannot account traffic accurately when there's a large traffic, because of packet pcap packet drop. For example, openbsd pcap drops about 1/3 packets on ~1gbps which makes accounting rather inaccurate.
To overcome the issue, I tried to capture number of bytes/packets from pf instead of pcap. It seems working on my environment and I wanted share the patch with others :)

Notes

  • cache.c and pf.c are largely borrowed from openbsd source tree.
  • pf should be enabled to make it work.
  • It requires to set -l flag to work property, as it cannot detect local interface address.
  • It does not handle ipv6 states.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant