2

I am using darkstat to collect data about bandwidth usage on my local box. My internet connection is provided by a 3G USB stick, connecting to a mobile network. Each time I connect to the internet I am given a different IP address. My question is how do I configure darkstat so that it does not include traffic to/from my own IP address in its output?

If I run darkstat as follows: 

sudo darkstat -i ppp0

then the charts that are produced shows my own IP address as having the highest usage:

IP              Hostname                            In          Out         Total       Last seen
49.***.***.***  ***.***.***.***.dyn.cust.vf.net.nz  19,790,395  2,683,631   22,474,026  2 secs
202.7.6.10      ubuntu.citylink.co.nz               472,523     7,624,768   8,097,291   5 mins, 46 secs
131.114.21.22   jake.unipi.it                       133,012     1,492,900   1,625,912   9 mins, 10 secs
91.189.92.184   zaurac.canonical.com                49,147      755,590     804,737     52 mins, 2 secs

... and so on.

I realise I can use the -f and/or -l switches to modify the range of IP addresses that are monitored, but I don't know how to set this up so that it excludes my dynamically assigned IP address.

Does anyone have any suggestions?

Jon Pawley
  • 185
  • 1
  • 1
  • 6
  • If you exclude traffic to and from your ip address then exactly what would darkstat show? – joeqwerty Nov 27 '12 at 21:08
  • @joeqwerty If I exclude my IP address, then I see precisely what I want to see. My problem is that each day my IP address changes, so I don't know how to automatically reconfigure darkstat to exclude the new IP address. Does that make sense? – Jon Pawley Nov 28 '12 at 18:55
  • No, I'm still confused. You want to monitor traffic to/from your machine but you want to exclude traffic to/from your machine? What am I not understanding here? – joeqwerty Nov 28 '12 at 18:58

1 Answers1

1

Well, you definitely need to include the address as an endpoint, but if you want to filter it out of the results dynamically, you can pipe it through a series of steps to read the address of the interface and then use that as a filter criteria. Below is an script that filters the IP address out by selecting the configuration from the interface, grepping for the inet address field, matching only the address numbers, and picking the first result, then setting an anchor.

Long version short, it will remove any line that starts with the IP of the interface in question.

sudo darkstat -i ppp0 | grep -v `ifconfig ppp0 \
   | grep 'inet addr' | egrep -o '[0-9.]+' | head -n 1 | sed 's/^/^/'``
Jeff Ferland
  • 20,239
  • 2
  • 61
  • 85