Is it possible to show traffic (byte) accouning per local source ip

bingo600

Thank you Gents

Will have a look at bandwidthd

/Bingo

bingo600

Can bwd only listen on one interface ?

Would one Select WAN as interface.
And tick several Subnet(s) for Statistics Collection

Is that a security risk (attack vector) , using wan ?

Would that show "Local ip to Inet" accounting ?

/Bingo

stephenw10

No it can only look at one and it needs to be internal to see the source IPs.

You need to use ntopng to log multiple interfaces. It should be able to show you that.

https://docs.netgate.com/pfsense/en/latest/monitoring/monitoring-bandwidth-usage.html#monitoring-on-multiple-interfaces

Steve

johnpoz

If your looking to just troubleshoot who is using what NOW for example you could use the darkstat package as well..

You could leave it running, but it doesn't reset per day, etc. But very easy way to find your top talkers for sure. Or what specific IPs have moved since you fired up darkstat

bingo600

Thanx Steve

I already have NtopNG running , but the ip accounting is not as easy as with bwd.

I have started bwd on "Lan" but sees nothing , does promiscuious have to be enabled ?

I already have that enabled via NtopNG (i think).

I can live with just one interface on bwd, if i can get it to log/account data.

bingo600

@johnpoz
I'll have a look at darkstat too.

And you are correct it is "Top talkers" i'd like to see.
And something like Cisco: ip accounting

johnpoz

Another one to track down top talkers is the iftop package, command line..

bingo600

I get no statistics on bwd.

How long time before stats are generated ?
Do i need promiscious ?

/Bingo

johnpoz

No you don't need promiscuous, but it will take a few minutes.. If your wanting to look now!! Your better off with darkstat or iftop..

bingo600

Dooh ....

I needed to remove the frame

johnpoz

I think it only updates like every 5 minutes or so though anyway.

You should see a timestamp in the top left on when it was last updated.

If you want pretty much realtime reporting then darkstat or iftop would be better tools. The other thing better with iftop is will show you the IP pair, ie where your client is sending or pulling data from.. Unlike bandwidthd that just reports on single IP.

Darkstat will give you the ports that were used, etc. But doesn't easy list the actual IP pairs that were doing the talking..

bingo600

Just tried darkstat , nice program.
But it seems to log all ip addy's , incl Inet.

Do you guys limit it in #of hosts , or just enable it when needed ?

/Bingo

johnpoz

I only turn it on if looking for something.

bingo600

@johnpoz said in Is it possible to show traffic (byte) accouning per local source ip:

I only turn it on if looking for something.

Makes sense.

DS has already revealed one of my ISP's cache servers (Local TV streaming channel) , i can see ~equal ATV4 in/out bytes to that ip

Thanx for that tip

bingo600

iftop seems nice too
Realtime top talkers src/dst

Thank you for guiding me here Steve/JP

I'll let bwd run , and keep the other two in the "toolbox"

/Bingo

bingo600

Hmm .... Seems like bwd's byte count is reset ?

My ATV4 was on 500MB , now it's on 76MB

Would iftop or DS interfere with bwd , causing a bytecount reset ?

johnpoz

I wouldn't think so.. What timezone are you in - is it just past midnight there, maybe you cycled days on bwd.

bingo600

CET (well CEST right now) - Europe

GUI says : Wed Aug 26 20:17:53 CEST 2020

bingo600

@johnpoz said in Is it possible to show traffic (byte) accouning per local source ip:

I wouldn't think so.. What timezone are you in - is it just past midnight there,

Hmmm i would have expected a US TZ from you

CN or ??

johnpoz

I'm US timezone - CST..