Is it possible to show traffic (byte) accouning per local source ip

bingo600

Is it possible to do traffic (byte) accouning per local source ip

In the latest days i have seen several hours of 90% utilization on a 100Mbit interface.

It's not an issue , but i would like to see what local ip(s) that are downloading that much.

As in a per source ip - Byte count in/out , for last week or last month

Is there any package, or trick that can make that ?

I have NtopNG installed , and maybe i just dont know if that's the tool to use.

Optimally i'd love to have a webpage showing that , but i'd settle for what i can get.

TIA
/Bingo

stephenw10

Bandwidthd can show you that.
https://docs.netgate.com/pfsense/en/latest/monitoring/monitoring-bandwidth-usage.html#bandwidthd

Steve

johnpoz

Yeah bandwidthd will do exactly what your asking

That top guy is my TV, so streaming stuff be it netflix, amazon prime or most of that is prob off my local plex server.

bingo600

Thank you Gents

Will have a look at bandwidthd

/Bingo

bingo600

Can bwd only listen on one interface ?

Would one Select WAN as interface.
And tick several Subnet(s) for Statistics Collection

Is that a security risk (attack vector) , using wan ?

Would that show "Local ip to Inet" accounting ?

/Bingo

stephenw10

No it can only look at one and it needs to be internal to see the source IPs.

You need to use ntopng to log multiple interfaces. It should be able to show you that.

https://docs.netgate.com/pfsense/en/latest/monitoring/monitoring-bandwidth-usage.html#monitoring-on-multiple-interfaces

Steve

johnpoz

If your looking to just troubleshoot who is using what NOW for example you could use the darkstat package as well..

You could leave it running, but it doesn't reset per day, etc. But very easy way to find your top talkers for sure. Or what specific IPs have moved since you fired up darkstat

bingo600

Thanx Steve

I already have NtopNG running , but the ip accounting is not as easy as with bwd.

I have started bwd on "Lan" but sees nothing , does promiscuious have to be enabled ?

I already have that enabled via NtopNG (i think).

I can live with just one interface on bwd, if i can get it to log/account data.

bingo600

@johnpoz
I'll have a look at darkstat too.

And you are correct it is "Top talkers" i'd like to see.
And something like Cisco: ip accounting

johnpoz

Another one to track down top talkers is the iftop package, command line..

bingo600

I get no statistics on bwd.

How long time before stats are generated ?
Do i need promiscious ?

/Bingo

johnpoz

No you don't need promiscuous, but it will take a few minutes.. If your wanting to look now!! Your better off with darkstat or iftop..

bingo600

Dooh ....

I needed to remove the frame

johnpoz

I think it only updates like every 5 minutes or so though anyway.

You should see a timestamp in the top left on when it was last updated.

If you want pretty much realtime reporting then darkstat or iftop would be better tools. The other thing better with iftop is will show you the IP pair, ie where your client is sending or pulling data from.. Unlike bandwidthd that just reports on single IP.

Darkstat will give you the ports that were used, etc. But doesn't easy list the actual IP pairs that were doing the talking..

bingo600

Just tried darkstat , nice program.
But it seems to log all ip addy's , incl Inet.

Do you guys limit it in #of hosts , or just enable it when needed ?

/Bingo

johnpoz

I only turn it on if looking for something.

bingo600

@johnpoz said in Is it possible to show traffic (byte) accouning per local source ip:

I only turn it on if looking for something.

Makes sense.

DS has already revealed one of my ISP's cache servers (Local TV streaming channel) , i can see ~equal ATV4 in/out bytes to that ip

Thanx for that tip

bingo600

iftop seems nice too
Realtime top talkers src/dst

Thank you for guiding me here Steve/JP

I'll let bwd run , and keep the other two in the "toolbox"

/Bingo

bingo600

Hmm .... Seems like bwd's byte count is reset ?

My ATV4 was on 500MB , now it's on 76MB

Would iftop or DS interfere with bwd , causing a bytecount reset ?

johnpoz

I wouldn't think so.. What timezone are you in - is it just past midnight there, maybe you cycled days on bwd.