bandwidth monitoring

[morficus]

I'm currently running Tomato v1.07 on my router (WRT54GL) and I'm pretty happy with it.

The real-time bandwidth monitor is awesome... but now I'm looking for something similar but a little more robust.

Does anyone know of a way to monitor network traffic/bandwidth usage but filter it out by IP (internal) or MAC address? For example... I have a total of 8 clients on my network, and I'll like to see that client-1 is using 20% while client-2 is using 30% and the rest are using 0% (for inbound and outbound). The monitor in tomato is nice... but it just shows general usage and only does it by interface (WAN, wireless, eth0, and so on) but I would like to see the traffic filtered out in more detail...

I think I can do it with MRTG, but I'm not sure.... and today I ran into PRTG (nor sure what the difference is at yet)... but again.. I'm not sure if any of these will work :-(

So does any know of a tool or firmware or ANYTHING that can accomplish what I'm looking to do?

thanks in advance guys

[+BudMan MVC]

Not sure if tomato supports it, but dd-wrt supports rflow -- so yeah you could get the type of data your looking for.

Using the rflow collector

http://www.dd-wrt.com/dd-wrtv2/rflow.php

With version 3, its supports export to a mysql database. You could get any info you want about the traffic going in an out of your router.. Or send this info to ntop, since rflow is really just a netflow generator to be honest you will have information overload ;)

Again -- not sure on tomato, but with say openwrt you could just use ipac-ng to doing ip based accounting.

with mrtg, yes something could be setup to query each machine for their traffic flow. Or I guess you could use the rflow data to generate these types of graphs.. Cacti comes to mind for setting up this type of accounting - but that would be more doing snmp queries to each device asking for its bandwidth usage. You could get traffic graphs for each device on your network, you might be able to query the router - but do not believe you could get traffic by mac or ip -- but more by interface - which tomato already gives. But you could query the devices directly for their traffic info.. This is what you would do with mrtg or prtg, or yes you could use traffic sniffing or netflows to report on this traffic.

With a firmware that supports rflow (neflow generator) you could send this info to prtg for example to graph it for you.

edit: Another quick solution would be to just run iptraf on the firmware that supports it, I do believe there is a openwrt package for iptraf which would give you the info your looking for I do believe.

I was looking into what you could do with prtg an netflows, an would be exactly what you want. But I think the freeware version is very limited -- at most 3 interfaces, so might be able to track the top current user of your network, or a few machines. You would have to look deeper.

But as already mentioned you could just run ntop on a box, an setup rflow on the router to send the data there.. You will have too much info then ;) You could check to see if tomato has added rflow support.

Edited August 30, 2007 by BudMan

[morficus]

ha- funny thing: when I google "tomato + rflow" the first hit is this thread :p

but yeah... I don't think tomato support rflow - it doesn't even support snmp, but there is a work-around to get snmp working with it.

guess I'll give dd-wrt another try... I didn't like the fact that it didn't have a 'built in' bandwidth monitor and the QoS options seemed a bit limited - I like tomato 'cuase it was simple and straight forward... but now it's a bit too simple ;)

I'll install dd-wrt along with rflow this weekend and see how it turns out

thanks a lot :yes:

oh.. and there is no such thing as "too much information" when it comes to my network :p I would LOVE to monitor every singe packet on my network.. but I don't have the time (nor means) of doing such an intensive project ;)

thanks again

[+BudMan MVC]

Well if you want to monitor every single packet -- thats pretty much ntop ;) You can use the rflow of dd-wrt to feed a ntop box..

Check ntop if you really want to know what is going on in your network ;)

[morficus]

wow.. rflow collect is AWESOME

it's pretty much what I was looking for :D

I'll read a bit about ntop before using.. thanks for the suggestion though

[+BudMan MVC]

yeah its pretty slick ;) Wait til you see ntop.

Nothing against tomato at all, its a real slick firmware - And its got dd-wrt an or openwrt in the eye candy dept for sure, but if you want to get down to business or you need support for more hardware you have use openwrt or dd-wrt.

Have Fun!