darkstat for OS X
you got stats!
Q: What is darkstat?
A: darkstat is the excellent open-source network traffic analyzer by Emil Mikulic. It sniffs all the data passing through the machine's network interfaces and presents the results graphically in your web browser. Check out the screenshot.

Q: Why is this page here?
A: So that I can spread the word about how good darkstat is. It really is very good.

Trouble was, in the bad old days of Mac OS X, darkstat wouldn't compile without some fussing about, so I put together a package for Puma & Jaguar users, a standard Mac installer with a few extra bits and bobs thrown in (thrown with loving care and attention, I might add - screenshots at the foot of this page), the sort of things we mac users expect.

At the time of writing we brushed-alluminium types are up to Panther; a matured and slick OS with most all the nobs on, and screwed in too. Developers, source-builders and the like have never had it so good, darkstat also compiles with no fuss whatsoever.

I maintain this package because in reality, only a minority of Mac users have the developers tools installed, but that shouldn't, and doesn't stop folks using this superb network monitoring tool for their homes, networks and servers.

In short, this is a place where you can get an up-to-date point-and-click Mac OS X version, and a lot more besides; without all that "messing about in the terminal" stuff.

Q: Okay, where can I get this package?
A: Right here..

Click here to download the darkstat v2.6 OS X installer package

If you have any problems with this installer package, please do not bug Emil about it, bug me!

Q:What else do I get?
A: Aside from the binary itself and its accompanying man page, the installer will install a StartupItem (so you always, got stats), some neat control scripts, and an uninstaller too, things that you can click! Scroll down for pics.

Please do check out the darkstat website. There are even a couple of links on there back to here, if you're feeling a bit loopy..

now available in blue!..
Feeling blue cuz you got no blue?

If you are compiling darkstat on some other platform, but want in on some of this blue action, it's easy enough to achieve. you have two options:

i. edit www.c (which is in the /src directory of the source package) altering the colour values therein to whatever your heart desires.

it's all fairly obvious, apart from maybe the bars themselves..

#define _IN "\"#3333CC\""
#define _I_R 0x33
#define _I_G 0x33
#define _I_B 0xCC

#define _OUT "\"#6699FF\""
#define _O_R 0x66
#define _O_G 0x99
#define _O_B 0xFF

remember to edit all the values. Or..

ii. download a ready-made blue version of the source file right here..

c source code for darkstat httpd
Also available in "classic" colours..
the old colours, a Linux thang.. this screenshot is from another machine on my LAN. (a peecee)
You can monitor your mac's network activity even before aqua loads..

if you have darkstat installed, clicking on this graph will take you to your own stats!
all the double-clickness you could want in a unix app! I just like to show off my desktop, okay you got me there 'sniff' and 'sniffoff', how hard can network monitoring be?
Take me to the Top!

Welcome to the comments facility!

previous comments (four pages)   show all comments

Adam Clark - 07.12.05 6:38 am

Your site is a very nice source of info.

My Mom - 17.03.06 4:55 am

Hey i was just wondering since i dont know a dang thing about macs but...
im trying to hack the school macs and im wondering if this thing can by any
chance capture passwords & user names???

corz - 17.03.06 12:03 pm

Nah, this doesn't capture the data passing through, just the amount of data.
Instead, try this, in your shell..
man tcpdump

Brin - 18.04.06 5:15 pm

My log says 'Can't get own IP address on interface en0'.

My G5 is connected to my home network via wireless using an Airport Extreme Card so is on interface en1.....I believe.

Can I still run Darkstat?

corz - 29.04.06 7:43 am

Yikes! Musta missed this one!

Your answer is further up the comments, did you spot it? Simply edit the interface name in the config.

Darkstat 3 is on its way, by the way. I'll post more about this later. gotta run...


Marco Antonio Medina Molina - 29.10.08 12:26 am

Hello, good tópic. Thanks. Bye. Salute.

Amir Behrooz - 10.07.09 5:59 pm

Here to see what the human interface is all about. smiley for :D

grendelum - 12.08.09 8:21 pm

no comments in three years? wow… are you still with us? You deserve mad kudos for this .pkg of an incredibly useful tool.

Many thanks for this excellent release... compiling the 3.0.712 source just wasn't happening (too many previous installs from diff sources… I couldn't figure out which files came from which install smiley for :erm: ).

Sadly, my .db from the original FiOS install was deleted, but the last 60 days haven't been too bad…

an image

Any word on upgrading to v3.x ? Many thanks again,


Wayne - 15.09.09 6:33 am

Your v2 package of darkstat under snow leopard gives me this in the logs..

Tue 15 Sep 2009 15:17:34 EST : starting service..
Unhandled transform (1) for ioctl group = 66 (B), number = 121, length = 12

I tried downloading and compiling latest darkstat 3 but it gives me this when I run your sniff script:
Tue 15 Sep 2009 15:16:33 EST : starting service..
error: illegal argument: "-d"
darkstat 3.0.711 (built with libpcap 2.4)

otherwise if I try the darkstat suggested way without your sniff I get this:

Last login: Tue Sep 15 15:17:34 on ttys001
macpro:~ wayne$ sudo darkstat -i eth0
489: error: pcap_open_live():
macpro:~ wayne$

so I'm a bit stuck!


corz - 23.09.09 7:36 pm

Still here! Although with no Mac, this area is basically for reference only.

The installer and stuff should still work fine, but I'd expect the binary itself is getting a bit long in the tooth. Sadly, I cannot create a v3 for mac.

I do have a nice darkstat installer for IPCop, though!


mar1hu4na - 02.05.12 8:28 am

Hey! When I try to run the sniff-file, it opens up terminal (so far, so good) and wants me to type in a password. Now, what password could this be? And, much worse, when I type any key, nothing will appear on terminal. I just tried to press enter, but it would show: "Sorry, try again" (yes, indeed). But I can't type in anything! can you help me?
thanks smiley for :)

First, confirm that you are human by entering the code you see..

(if you find the code difficult to decipher, click it for a new one!)

Enter the 5-digit code this text sounds like :

lower-case you, Upper-Case Gee, zeehrow, lower-case en, Upper-Case En


Welcome to corz.org!

I'm always messing around with the back-end.. See a bug? Wait a minute and try again. Still see a bug? Mail Me!