Not sure if Traffic Monitor per deivce is correct

[JoeSchmoe007]

Using Merlin's 3.0.0.4.270.26 fw.

Or maybe numbers don't mean what I think they mean (include some kind of local traffic?). See attached screenshots. Note that when I used Original Tomato FW in my old WRT54GL router my total monthly traffic was about 40-60 GB/month, that includes watching several movies from Amazon. I don't do any P2P.

1) Numbers from per-device screen just don't add up to be equal to numbers per-month screen for April

2) First device on per-device screen is my VOIP adapter. I find it hard to believe it used up 1.4 GB down/1.7 GB up in 2 days given I only spoke on the phone for maybe 10 minutes per day. And even if I didn't - is still seems way too much.

3) Third device on the list is my laptop. 80 GB down in 2 days is just impossible. This is more that I ever used in month.

Monthly totals seem about right, or at least in the ballpark with my past usage numbers form Tomato and WRT54GL.

Any ideas?

 

[cmillar6]

Try running a bandwidth monitoring program on your laptop to see if it agrees with the router.

 

[RMerlin]

Are you sure these devices kept the same IP throughout the month?

 

[JoeSchmoe007]

Are you sure these devices kept the same IP throughout the month?

I'd say 99% positive. Even if they didn't - no device on my network could have consumed that much.

Am I correct that when totals per device are added up it should be equal to total for the network?

 

[RMerlin]

I'd say 99% positive. Even if they didn't - no device on my network could have consumed that much.

Am I correct that when totals per device are added up it should be equal to total for the network?

In theory, yes. Per IP tracks the traffic by counting everything going through the FORWARD chain. I assume one thing that could skew results a bit is if you use the NAT loopback for anything - then you would probably get the traffic going through the FORWARD chain instead of just through the switch.

I never looked at how the regular traffic monitor accounted the global traffic.

 

[JoeSchmoe007]

Just tested it again and now numbers seem to make sense. Here is what I did:

Make sure there is just one wired client connected.

Reset traffic logging files and rebooted router to zero-out all numbers.

Downloaded 950MByte file (SQL Server 2012 SP1)

Global Traffic monitor for last 24 hours was showing 980MBytes (or something very close) immediately after download ended.

Daily Download per device was showing about 770Mbytes at the same time. After I logged out from the router and logged back again it was showing 960 MBytes.

I will monitor it for a while and report back if I have any significant discrepancies again.

 

[professordave]

where is the per device traffic monitoring in the GUI?

Hello,

Where is the per traffic monitoring in the GUI?

I see total, but not per device.

Thanks

Using Merlin's 3.0.0.4.270.26 fw.

Or maybe numbers don't mean what I think they mean (include some kind of local traffic?). See attached screenshots. Note that when I used Original Tomato FW in my old WRT54GL router my total monthly traffic was about 40-60 GB/month, that includes watching several movies from Amazon. I don't do any P2P.

1) Numbers from per-device screen just don't add up to be equal to numbers per-month screen for April

2) First device on per-device screen is my VOIP adapter. I find it hard to believe it used up 1.4 GB down/1.7 GB up in 2 days given I only spoke on the phone for maybe 10 minutes per day. And even if I didn't - is still seems way too much.

3) Third device on the list is my laptop. 80 GB down in 2 days is just impossible. This is more that I ever used in month.

Monthly totals seem about right, or at least in the ballpark with my past usage numbers form Tomato and WRT54GL.

Any ideas?

 

[crazyea]

You can enable per ip monitoring on the Tools tab>Other settings>Traffic Monitoring.

 

[DrTeeth]

I have had some very strange data from this feature.

My ISP monitors peak traffic as I have a limit. When they would record <1GB, the router would record LOADS more traffic. I cannot rust the figures - shame as I would like to be able to see which of my two YouTube-addicted children download the most.

Merlin's theory is that some LAN traffic could be counted too.

DrT

 

[linkmaster]

LAN traffic is definately counted , my NAS is shown/included on the traffic data used list and it never sends any data out to the WAN.

 

[DrTeeth]

The trouble is that LAN traffic is getting mixed up with WAN traffic making the figures useless. I was hoping to be able to monitor my childrens download amounts during peak times.

When I asked, Merlin said that in *some* cases, LAN traffic gets recorded. The impression I got from his emails is that it should not.

Regards

DrT

 

[RMerlin]

The trouble is that LAN traffic is getting mixed up with WAN traffic making the figures useless. I was hoping to be able to monitor my childrens download amounts during peak times.

When I asked, Merlin said that in *some* cases, LAN traffic gets recorded. The impression I got from his emails is that it should not.

Regards

DrT

I monitor traffic in the FORWARD table of the firewall. LAN to LAN traffic should never even reach this table since it should goes directly through the switch and never reach the firewall. So, I don't know what could make some traffic end up in that table instead of remaining local.

 

[ScottW]

I monitor traffic in the FORWARD table of the firewall. LAN to LAN traffic should never even reach this table since it should goes directly through the switch and never reach the firewall. So, I don't know what could make some traffic end up in that table instead of remaining local.

How about LAN-to-LAN traffic that uses the WAN address (loopback)?

 

[RMerlin]

How about LAN-to-LAN traffic that uses the WAN address (loopback)?

That's one of the cases I mentioned previously that would potentially be counted, since it goes through the firewall. I doubt it amounts for the huge traffic some are seeing, unless they are using a dyndns address internally.

 

[DrTeeth]

According to my figures, my connection once downloaded 68GB in less than an hour on one occasion. I have the router setup as a bog standard router (nothing fancy). The max d/l speed for my internet connection is 4.6MB/s.

Happy to try any debug builds or check any settings.

DrT

 

[ScottW]

That's one of the cases I mentioned previously that would potentially be counted, since it goes through the firewall. I doubt it amounts for the huge traffic some are seeing, unless they are using a dyndns address internally.

Apologies, I see you did address loopback in an earlier post.

Seems like for some that could be large amounts of data. For example, I know that our portable devices map a lot of internal resources using their DynDNS names, so they will work from inside and outside the LAN. That includes a couple servers and a bunch of IPCams streaming video.

 

[RMerlin]

According to my figures, my connection once downloaded 68GB in less than an hour on one occasion. I have the router setup as a bog standard router (nothing fancy). The max d/l speed for my internet connection is 4.6MB/s.

Happy to try any debug builds or check any settings.

DrT

Do you store any files on a disk plugged to the USB router? That could possibly be another source of unexpected traffic.

 

[RMerlin]

You can try the following rules in a firewall-start script to replace the current accounting rule with two separate rules that will ensure that only traffic to or from WAN gets accounted (which means it will no longer count traffic sent over the NAT loopback):

iptables -D FORWARD -m account --aaddr 192.168.1.0/255.255.255.0 --aname lan
iptables -I FORWARD -m account -i `nvram get wan0_ifname` --aaddr 192.168.1.0/255.255.255.0 --aname lan
iptables -I FORWARD -m account -o `nvram get wan0_ifname` --aaddr 192.168.1.0/255.255.255.0 --aname lan

Replace 192.168.1.0 with your own network IP (it must end with 0).

Note that these are backticks, NOT quotes. Use copy/paste if unsure how to reproduce this accurately.

 

[DrTeeth]

Do you store any files on a disk plugged to the USB router? That could possibly be another source of unexpected traffic.

No. It is on my to-do list...still .

DrT

 

[RMerlin]

No. It is on my to-do list...still .

DrT

Anyway, I tested last night, and traffic to/from plugged USB disk wasn't being counted.

The only unexpected source of traffic I could track down was over the NAT loopback. Any other odd result would be down to a bug in the ipt_account kernel module most likely - something beyond my skills to debug.