Dec 17
Windows hints Darkstat Website: http://dmr.ath.cx/net/darkstat/
Darkstat for Windows port Website: http://www.neophob.com

You need WinPcap to use this tool: http://www.winpcap.org - I tested it with version 4.1 beta2.

Download:
Windows Binary
Windows Source (Ugly hack)

Example:
c:\>darkstat
darkstat 3.0.707 (built with libpcap 2.4)

WinPcap devices:
WARNING: if you don't see any devices here, make sure
you installed WinPcap drivers
         http://www.winpcap.org/install/default.htm

\Device\NPF_GenericDialupAdapter
        Description: Adapter for generic dialup and VPN capture
        Loopback: no

\Device\NPF_{86AAB447-88AE-404D-86CB-D7E7A909B9BE}
        Description: Broadcom NetXtreme Gigabit Ethernet Driver
        Loopback: no
        Address Family: #2
        Address Family Name: AF_INET
        Address: 10.226.64.65
        Netmask: 255.255.255.0
        Broadcast Address: 255.255.255.255
....       



As you can see in this example, 2 NIC's are found:
    \Device\NPF_GenericDialupAdapter
    \Device\NPF_{86AAB447-88AE-404D-86CB-D7E7A909B9BE}

IMPORTANT: you need to put quotation marks around your device string else you'll receive a error like this:

error: pcap_open_live(): Error opening adapter: The system cannot find the device specified. (20)


Example:
c:\>darkstat -i "\Device\NPF_{86AAB447-88AE-404D-86CB-D7E7A909B9BE}"
or
c:\>darkstat -i \\Device\\NPF_{86AAB447-88AE-404D-86CB-D7E7A909B9BE}
A succesfull start of darkstat look like this:
darkstat (03516): starting up 
darkstat (03516): daemonizing to run in the background!
darkstat (03516): parent waiting
darkstat (02220): I am the main process
darkstat (02220): DNS child has PID 3616
darkstat (02220): caplen is 54
darkstat (02220): capturing in promiscuous mode
darkstat (02220): listening on 0.0.0.0:667
darkstat (02220): loaded 11 protos
darkstat (02220): loaded 0 tcp and 0 udp servs, from total 0
darkstat (02220): chrooted into: .
darkstat (02220): local_ip update(\Device\NPF_{86AAB447-88AE
-404D-86CB-D7E7A909B9BE}) = 10.226.64.65
darkstat (03516): parent done reading, calling waitpid
darkstat (03516): waitpid ret 0, status is 0

To see darkstat in action point your browser to http://127.0.0.1:667/.

Advanced:
If you want to log your darkstat stuff, you may use this example:
c:\>darkstat -i "\Device\NPF_{86AAB447-88AE-404D-86CB-D7E7A909B9BE}" --chroot /cygdrive/c/ --daylog daily

To use your c:\ root drive you need to use /cygdrive/c/ (Cygwin syntax).

 

Posted by michu

Defined tags for this entry: ,

0 Trackbacks

  1. No Trackbacks

1 Comments

Display comments as(Linear | Threaded)
  1. Dodfr says:

    Nice tool, but I found a bug (memleak) that eat about 4KB per second (XP SP3 WinPCap 4.1.1).

Add Comment


Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.
E-Mail addresses will not be displayed and will only be used for E-Mail notifications

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA