Merlin traffic monitor vs Trend Micro traffic analyzer

[xtremesniper]

I'm seeing average daily internet usage as reported by my ISP as hovering around 10-20 GB per day, so I wanted to dig into my router settings to see which device is the culprit. All I want to know is which device is using that much data.

I understand that by enabling Traffic Analyzer, it will engage Trend Micro's privacy policy... but I see that Merlin's firmware seems to have this feature listed on the website:

• Enhanced traffic monitoring: adding graphical charts, and traffic monitoring per client IP

My question is...

1. Would Merlin's traffic monitoring provide me with the info I'm looking for? (per device internet usage per day)
2. Does it do all the tracking on the router only?
3. As an alternative, if I enabled Trend Micro's Traffic Analyzer for a few days and then disabled it, would the data siphoning stop? I'm worried that once the EULA is activated, there's no going back.

 

[L&LD]

At least on RMerlin firmware, you can 'withdraw' from the EULA.

Whether it would give you the information you need? It may or it may not.

What router are you talking about?

What firmware is installed on it now?

Does it have anything similar to what you want/need?

If you can flash RMerlin firmware, you will need to fully reset the router (at least, if your network starts going south on you and no simple fixes exist).

 

[Jeffrey Young]

I just tried this on my 86U (I use traffic monitor with TrendMicro Declined). I get daily usage as a whole, but the per client list is empty. When I try to enable, the router wants me to agree to Trend Micro.

It would seem that the Merlin enhancements are a pull from the data that Trend Micro creates.

Looks like this will not work for what you want.

 

[ColinTaylor]

I just tried this on my 86U (I use traffic monitor with TrendMicro Declined). I get daily usage as a whole, but the per client list is empty. When I try to enable, the router wants me to agree to Trend Micro.

It would seem that the Merlin enhancements are a pull from the data that Trend Micro creates.

Looks like this will not work for what you want.

I'm surprised there's even an option in the GUI to enable it as Merlin's old "IPTraffic (per IP monitoring)" was removed from the HND models.

 

[xtremesniper]

Thanks for the responses. My router is the 86U and the firmware is the latest stock 3.0.0.4.386_41634.

I've been watching the "Traffic Monitor" tab in the stock firmware and it indeed provides "total" usage across all devices as a whole, but no breakdown. And in the QoS screen I can see the real-time data up/down per device even though I have QoS disabled, but no quantified totals.

If Merlin's firmware doesn't provide any additional data without having to agree to Trend Micro's EULA, then I guess that's a bummer. I thought maybe the per IP monitoring would be the solution, but it's been removed?

I understand that Trend Micro's services would be required for app analytics, but why wouldn't the router be able to tell me how much bandwidth is being used just at the per-device level?

 

[Jeffrey Young]

I'm surprised there's even an option in the GUI to enable it as Merlin's old "IPTraffic (per IP monitoring)" was removed from the HND models.

See below, the traffic monitor tab works great (rstat). As soon as I try to turn statistics on, the Router wants me to agree to Trend Micro's privacy statement.

 

[ColinTaylor]

See below, the traffic monitor tab works great (rstat). As soon as I try to turn statistics on, the Router wants me to agree to Trend Micro's privacy statement.

Ah, yes. That's a different thing. You're looking at the Traffic Analyzer which is part of the Trend Micro stuff. The "IPTraffic (per IP monitoring)" was a Merlin addition to the Traffic Monitor. I think IPTraffic might still be present on the non-HND routers.

 

[xtremesniper]

I'm not familiar with what HND routers are. Does the 86U fall under the non-HND category?

 

[ColinTaylor]

I'm not familiar with what HND routers are. Does the 86U fall under the non-HND category?

The RT-AC86U is an HND router.

https://github.com/RMerl/asuswrt-me...ic-monitoring#iptraffic-monitoring-per-device
https://www.snbforums.com/threads/i...measures-traffic-by-device.49951/#post-444797

 

[xtremesniper]

Thanks for the links. I get it now.

This option is called IPTraffic. This feature is only available on older models, as it's not compatible with the kernel used by the RT-AC86U and newer models.

It's unfortunate but it sounds like I'll have to enable traffic analyzer to get any meaningful device level tracking, and hope that once it's "off" it will actually stop sending data to trend micro.

At least on RMerlin firmware, you can 'withdraw' from the EULA.

I think this might still be possible on stock firmware, but it would be nice if someone could confirm because when I go to this location nothing shows up since I haven't enabled any services yet.
From https://www.asus.com/support/FAQ/1039637 :

If you would like to disable sharing your information with Trend Micro through the above functions, please go to: Router web GUI > Advanced settings > Administration > Privacy.

 

[L&LD]

Seems like it is the same.

 

[Jeffrey Young]

Ah, yes. That's a different thing. You're looking at the Traffic Analyzer which is part of the Trend Micro stuff. The "IPTraffic (per IP monitoring)" was a Merlin addition to the Traffic Monitor. I think IPTraffic might still be present on the non-HND routers.

YEs, you are right Colin. I may have to take the old 68U out of storage to compare.

 

[Fox23]

Thanks for the links. I get it now.

It's unfortunate but it sounds like I'll have to enable traffic analyzer to get any meaningful device level tracking, and hope that once it's "off" it will actually stop sending data to trend micro.

I think this might still be possible on stock firmware, but it would be nice if someone could confirm because when I go to this location nothing shows up since I haven't enabled any services yet.
From https://www.asus.com/support/FAQ/1039637 :

I was able to "opt out" on my a86U after enabling TrendMicro for a while last year, I haven't done any snooping to ensure it really is off but have no reason to think it's not. To be completely sure your router's in the same state one option would be to back up all settings and jffs files before enabling anything, turn on trend micro and gather the data you need, then do a factory reset, then restore from your backup files.

 

[xtremesniper]

I was able to "opt out" on my a86U after enabling TrendMicro for a while last year, I haven't done any snooping to ensure it really is off but have no reason to think it's not. To be completely sure your router's in the same state one option would be to back up all settings and jffs files before enabling anything, turn on trend micro and gather the data you need, then do a factory reset, then restore from your backup files.

Thanks! That's a pretty good idea... I think I would normally trust it to be "off" when it says it's off, but these days I've been extra skeptical.

 

[Jeffrey Young]

YEs, you are right Colin. I may have to take the old 68U out of storage to compare.

I took my 68U out of storage (384.18), but was not able to find any IPMonitor section. Just the trend micro stuff

 

[ColinTaylor]

I took my 68U out of storage (384.18), but was not able to find any IPMonitor section. Just the trend micro stuff

Did you enable it at Tools > Other Settings > Enable IPTraffic (per IP monitoring) ?

 

[Jeffrey Young]

Did you enable it at Tools > Other Settings > Enable IPTraffic (per IP monitoring) ?

No, I did not look there. I will have to that next weekend.

 

[xtremesniper]

The funny thing is the data in the Traffic Monitor -> Daily section doesn't seem to respect time zone settings. It starts recording usage against the next day at around 6pm which kind of indicates to me it's based on UTC (since I'm in EST).

It doesn't seem to be a problem in the "Last 24 hours" section though.

What a mess...