How DataSabi works

This page explains the technical design of DataSabi for users who want to understand what the software is doing on their machine.

The collector

The datasabi-collector service captures network packets using libpcap — the same library used by Wireshark and tcpdump. It runs as a systemd service and starts at boot.

For each packet, the collector:

Reads the source and destination IP addresses and ports from the packet header
Looks up which process on this machine owns that connection (by reading /proc/net/tcp, /proc/net/tcp6, and the per-process /proc/<pid>/fd and /proc/<pid>/exe)
Resolves the process to a human-readable app name — from its .desktop file where one exists, a built-in table for common system services, or a tidied-up version of the executable name
Adds the packet's byte count to that app's running total for the current network

Only byte counts are stored. The collector never logs packet payloads, URLs, domain names, or any content.

Why it needs elevated permissions

Capturing packets and mapping them to processes requires four Linux capabilities, all granted by systemd — the service never runs as root:

CAP_NET_RAW and CAP_NET_ADMIN — required by libpcap to open raw packet sockets
CAP_SYS_PTRACE and CAP_DAC_READ_SEARCH — required to read /proc/<pid>/exe and /proc/<pid>/fd for processes owned by other users, so the collector can attribute each connection to the app that made it

The service runs as the datasabi system user with NoNewPrivileges=yes, ProtectSystem=strict, and ProtectHome=read-only. It cannot gain capabilities beyond those four.

The Unix socket

The collector exposes its data over a Unix socket at /run/datasabi/collector.sock. The socket is group-owned by datasabi with mode 660, so only members of the datasabi group can connect to it. This is why a full logout is required after install — group membership isn't effective until your next login session.

The desktop app

The DataSabi app connects to the collector socket, requests the usage data it needs, and renders the dashboard. The app never opens the database directly — all data access goes through the collector. Nothing leaves your machine.

The local database

Usage history is stored in a SQLite database at /var/lib/datasabi/usage.db, owned by the datasabi system user. Data is retained at different resolutions:

Per-minute rows: kept for 7 days, then rolled up into hourly totals
Hourly rows: kept for 90 days, then rolled up into daily totals
Daily totals: kept indefinitely

Source code

The collector is Apache-2.0 and fully open source: github.com/arkodeontech/datasabi-collector

Next steps

Issue with this page? Email isaac@arkodeon.com

arrow_backUninstalling

Privacyarrow_forward