reading traffic monitoring per ip data

[mekabe remain]

Hi,

I have enabled "IPTraffic (per IP monitoring)" and it displays output on traffic analyzer page.
I would like to import this data to a Grafana server.
How can I access the data through CLI ?

I couldn't find it using "iptables"

thanks

 

[mekabe remain]

I'd appreciate any info.

 

[RMerlin]

The IPTraffic database is not user-readable.

 

[mekabe remain]

ok but the input to that DB should be readable ? no ?
if that's not the case, can I use iptables to keep IP accounting info ?

 

[mekabe remain]

andi f the web page on router can display this data (IPTraffic) there must be a way to read it through shell. AM I wrong ?

 

[john9527]

google "github rstats-cstats"

 

[mekabe remain]

google "github rstats-cstats"

thanks.
I installed python and run the script as:
python rstats.py /tmp/var/lib/misc/rstats-history.gz

it gives daily and monthly data.
what about live data ?

 

[mekabe remain]

also I don't see any "per IP" traffic on the output.
Am I using the wrong file ?

 

[ColinTaylor]

The "per IP" data is in the cstats file, not the rstats.

 

[mekabe remain]

The "per IP" data is in the cstats file, not the rstats.

ok. is this the correct usage ?
python cstats.py /tmp/var/lib/misc/cstats-history.gz

In the output I don't see any IP addresses.

 

[ColinTaylor]

Sorry, I can't remember the specifics. I haven't used the cstats files for years.

 

[john9527]

Sorry, but I can't help further either. Knew of those scripts, but never used them.

 

[mekabe remain]

thanks for all the answers. it seems nobody has enough information about IPTraffic.
since it is visible through web page I think it should be readable through CLI somehow.
But how ?
anyway, I'll try to do it using iptables accounting.

 

[RMerlin]

thanks for all the answers. it seems nobody has enough information about IPTraffic.
since it is visible through web page I think it should be readable through CLI somehow.
But how ?

The problem is the data isn't stored in a human-readable format, it uses double linked lists of data. Decoding the content requires someone to write a special program to process the data.

 

[mekabe remain]

ok. but the asp code (html) can read the data and display it. So the code is already inside the firmware. Isn't it ?
besides someone already wrote a python code (rstats - cstats given above)
but it doesn't read the "per IP" format. SOmeone who knows the format could easily modify the code to display it properly.
am I wrong ?

 

[L&LD]

@mekabe remain, do you know anyone who works at Asus in their router development division?

This is all probably a closed source part of the firmware?

 

[ColinTaylor]

besides someone already wrote a python code (rstats - cstats given above) but it doesn't read the "per IP" format.

Yes it does. See the image attached to this post.

Note that the router's realtime graph is not read from the cstats database but directly from ipt_account [Link] (which is the same place that cstats gets its source data from).

 

[mekabe remain]

ok.
I see the IP addresses now in cstats output but there is no data:
admin@RT-AC88U-DF80:/tmp/home/root# python /jffs/scripts/cstats.py /tmp/var/lib/misc/cstats-history.gz
192.168.254.0 D 04/24/2020 0 0
192.168.254.0 M 04/01/2020 0 0
192.168.254.199 D 04/24/2020 0 0
192.168.254.199 M 04/01/2020 0 0
192.168.254.20 D 04/24/2020 0 0
192.168.254.20 M 04/01/2020 0 0
192.168.254.249 D 04/24/2020 0 0
192.168.254.249 M 04/01/2020 0 0
192.168.254.39 D 04/24/2020 0 0
192.168.254.39 M 04/01/2020 0 0

However, I see that the file under proc (/proc/net/ipt_account/lan) has the data that I need.
So no need for cstats. BUT, I couldn't find which data field I should get for measuring throughput. Any ideas ?


admin@RT-AC88U-DF80:/tmp/home/root# cat /proc/net/ipt_account/lan | grep 40
ip = 192.168.254.40 bytes_src = 3221956 1520560 1701396 0 0 packets_src = 11531 5084 6447 0 0 bytes_dst = 29225962 7017091 22208871 0 0 packets_dst = 28689 8916 19773 0 0 time = 2

 

[ColinTaylor]

https://web.archive.org/web/20071012044620/http://www.svn.barbara.eu.org/ipt_account/wiki/Usage

 

[RMerlin]

ok. but the asp code (html) can read the data and display it.

No, it doesn't. The web server queries the data from the cstats daemon, reads the data, processes it, and then insert into the web page the data in an array format that the Javascript can handle.

https://github.com/RMerl/asuswrt-merlin.ng/blob/mainline/release/src/router/httpd/data_arrays.c#L864

https://github.com/RMerl/asuswrt-merlin.ng/blob/mainline/release/src/router/cstats/cstats.c

The data is stored in linked trees. It's not something you can easily parse through a script, you need to reimplement the C macros that are built to walk down the tree.