Re: data usage metering by IP on openwrt.

17 Sep 2013

      On 2013-09-17 20:28, cory seligman wrote:
...
Does anyone know of a simple way of showing which of my machines on my home
network is hogging all my data?
I recently discovered that something on my network is using ~30M per hour
all day and night and I'd like to find out what it is. I guess I could go
around and turn each thing off and check my ISP's usage meter over a few
hours, but there must be a better way of doing it.
I have a WRT54GL running:
Firmware              OpenWrt Kamikaze - With X-Wrt Extensions 8.09
Kernel          Linux 2.4.35.4 #15 Fri Jan 22 11:36:55 CST 2010
MAC          00:18:39:ED:A2:73
Device         Linksys WRT54G/GS/GL
Board         Broadcom BCM5352 chip rev 0
Username          root
Web mgt. console          Webif²
Version        r4838
I'm very lazy, so an installable package that can do this over a web
interface would be ideal, but not necessary.
anyone?
Given you're running Kamikaze, you're unlikely to have the
iptables-utils package installed (you may be able to install it, giving
you the iptables-save and iptables-restore commands; a script using
these would be quicker), so in its absense:

  # Create a chain calle log_outgoing
  iptables -N log_outgoing
  # Create a chain calle log_incoming
  iptables -N log_incoming
  # For every IP address in an IP class C:
  let ip=1
  while [ "$ip" -lt 254 ]
  do
    # Add a null iptables rule that does nothing but match the IP address
    # and count the packets both for incoming and outgoing traffic
    # (Specify your own subnet unstead of '192.168.2' below)
    iptables -I log_outgoing -s "192.168.2.$ip"
    iptables -I log_incoming -d "192.168.2.$ip"
    let ip=ip+1
  done
  # Ensure that all traffic passing through the router goes to the new
  # chains we created.
  iptables -I FORWARD -j log_incoming
  iptables -I FORWARD -j log_outgoing

Then, to show how much traffic each host used:

  iptables -vnL log_incoming | grep -v '^ \+0'
  iptables -vnL log_outgoing | grep -v '^ \+0'

To remove the iptables rules added above:

  # Remove the redirects from the forward chain
  iptables -D FORWARD -j log_incoming
  iptables -D FORWARD -j log_outgoing
  # Delete the custom chains we created
  iptables -X log_incoming
  iptables -X log_outgoing

Also, if you were running a newer version of OpenWRT (I run Backfire),
I think you can see the counters for each iptables rule from the web
interface. I'm not sure if this is available in Kamikaze.

-- 
Regards,
Matthew Cengia