Extracting Real-time Stats

[wheelq]

Traffic Analyzer is unrelated to rstats or cstats. It's based on Trend Micro's DPI engine, which is a completely separate thing.

So it is
TrafficAnalyzer/TrafficAnalyzer.db right?
If so, then what's the point of cstats and rstats if cstats are pretty much a duplicate of the Traffic Analyzer...

And now I'm after the logs for connecting to remote IPs instead of the hosts

 

[RMerlin]

So it is
TrafficAnalyzer/TrafficAnalyzer.db right?
If so, then what's the point of cstats and rstats if cstats are pretty much a duplicate of the Traffic Analyzer...

And now I'm after the logs for connecting to remote IPs instead of the hosts

Traffic Analyzer is a proprietary implementation from Asus which relies on the Trend Micro DPI engine, and is rather hard to use when trying to track down traffic for specific periods of time or specific devices. To be honest, the Traffic Analyzer page should be scrapped, and completely redesigned. I always had a hard time extracting any meaningful data out of it personally.

Traffic Monitoring works without the Trend Micro DPI engine, and will be able to easily give you historical tally of daily and monthly traffic, making it easy to compare with your traffic usage reported by the ISP.

IPTraffic will let you see which device used what amount of traffic, again with easy to navigate historical data, and without the need for the Trend Micro DPI engine.

Note that both Traffic Monitoring and IPTraffic were implemented years before Asus implemented Traffic Analyzer, which is why today we have all three available.

 

[wheelq]

Traffic Analyzer is a proprietary implementation from Asus which relies on the Trend Micro DPI engine, and is rather hard to use when trying to track down traffic for specific periods of time or specific devices. To be honest, the Traffic Analyzer page should be scrapped, and completely redesigned. I always had a hard time extracting any meaningful data out of it personally.

- Takes some time but it is doable. Just missing IPs, MACs are useful but...still MAC's And shame it doesn't contain destination IP's because this is what I'm after

Traffic Monitoring works without the Trend Micro DPI engine, and will be able to easily give you historical tally of daily and monthly traffic, making it easy to compare with your traffic usage reported by the ISP.
- Correct, but no destination IP's/Hostnames. Are you talking about the tomato_cstats here?

IPTraffic will let you see which device used what amount of traffic, again with easy to navigate historical data, and without the need for the Trend Micro DPI engine.

- Is it tomato_cstats or tomato_rstats?

Note that both Traffic Monitoring and IPTraffic were implemented years before Asus implemented Traffic Analyzer, which is why today we have all three available.

- Thanks, didn't know that.

 

[RMerlin]

hamne it doesn't contain destination IP's because this is what I'm after

That would probably require too much resources/memory to accumulate and store.

 

[wheelq]

And reverse DNS lookup isn't ?

 

[wheelq]

And for some reason, why I run the cstats.py script on my asus, everything works great. But whenever I try yusing m laptop and python (I tried v 2.7, build#2.7.15) script fails:

10.0.1.0 M 03/01/2016 141644979186 10780244665
Traceback (most recent call last):
File "cstats.py", line 159, in <module>
main()
File "cstats.py", line 153, in main
CStats(args[0]).dump()
File "cstats.py", line 79, in dump
self.dump_record()
File "cstats.py", line 99, in dump_record
self.unpack_value("l", 4)
File "cstats.py", line 123, in unpack_value
value, = struct.unpack(unpack_type, self.get_value(size))
struct.error: unpack requires a string argument of length 8


"struct.error: unpack requires a string argument of length 8"

 

[wheelq]

IPTraffic will let you see which device used what amount of traffic, again with easy to navigate historical data, and without the need for the Trend Micro DPI engine.

Which file is it?

 

[RMerlin]

Which file is it?

Data is not logged in a readable file, it's stored in data structures that need to be parsed, and will be shown on the webui under Traffic Monitor.

 

[wheelq]

I know it's probably not human readable file, but still would like to know which file is it? Are you talking about cstats or rstats file?
I have also found traffic.db which contains exactly same data as TrafficAnalyzer/TrafficAnalyzer.db but hasn't been udpated since...November 2017 so I guess it is no longer in use.

I'd love to stick with cstats and rstats only but TrafficAnalyzer provides more detailed data.

 

[ColinTaylor]

It's the cstats file as previously explained.

 

[wheelq]

It's the cstats file as previously explained.

Not really, couldn't find any definitive answer. Now I know, thanks.

Have you got working script for extracting data from rstats and cstats? I only found some for cstats but had to modify it to work.

 

[ColinTaylor]

Apart from the one you're already using the only other ones I'm aware of are these:

https://github.com/VREMSoftwareDevelopment/rstats-cstats
https://github.com/emjelde/rstats

 

[RMerlin]

rstats = Asus's traffic monitor
cstats = Merlin/Tomato's IPTraffic
traffic.db = Trend Micro's Traffic Analyzer

Don't remember the format of rstats. Cstats uses linked list structs. Traffic.db uses sqlite3.

 

[wheelq]

thank you so much

 

[wheelq]

ok, so I flashed the device, and I get the traffic.db, rstats but no trace of cstats.
Enabled:
- Adaptive QoS->Web history
- Adaptive QoS->Bandwidth Monitor-> App analysis
- Traffic analyzer->Statistic (ON)
- Tools->Other settings->Custom location->(checked to reset data files). This setting creates rstats.

But no trace of cstats...which option enables it?

 

[ColinTaylor]

But no trace of cstats...which option enables it?

Tools > Other Settings > Enable IPTraffic (per IP monitoring)

What router and firmware version are you using? IPTraffic doesn't exist on the RT-AC86U.

 

[wheelq]

Tools > Other Settings > Enable IPTraffic (per IP monitoring)

What router and firmware version are you using? IPTraffic doesn't exist on the RT-AC86U.

Ah, now I just got the 86u oh well thanks!