How to monitor internet usage per computer

[azaran]

Hi all

My ISP (COX) has decided to place a hard cap on usage to 1TB. 1TB sounds pretty solid, except both my roommate and I are gamers and in the last few months since he's started doing more casting of matches we've been nearly hitting that 1TB mark.

I'm hoping to find a way of tracking both our usage so we can see who is responsible for what, and what may have to be reined in to avoid overage charges in a fair manner to the both of us.

Currently running a Netgear Nighthawk R7000 for a router. Computers are cabled in to the router with only phones, tablets, and sonos using the wifi. Ideally I'd like to avoid having to upgrade the router since it's fairly new. But if doing so helps save me hundreds in overage charges then so be it.

Also before it gets suggested, no, upgrading to a higher tier package isn't possible. Cox has decided on a 1TB limit for all residential accounts. If you go over the limit they give you an extra 50GB automatically at $10 a pop. I'd consider a business account but in general their speeds are lower and more expensive than the residential rates from what I've seen and I've gotten fond of 100+Mbps speeds.

 

[Dark Lord of Tech]

Glasswire Possibly.
https://www.glasswire.com/

https://www.howtogeek.com/222740/how-to-the-monitor-the-bandwidth-and-data-usage-of-individual-devices-on-your-network/

 

[bill001g]

If you both agree to monitor your connections it can be done with the above software pretty easy but you must load it on both machines and then manually correlate the information.

Trying to do it with the router is a pain mostly because few routers have any features to collect data like that. If you are lucky they may show current utilization and what machine is active but few have historic information.

You can look at using dd-wrt which give you more options. The one I used to use was dd-wrt version of what cisco calls netflow but you need a external machine to collect the data. The gargoyle firmware is one of the few to understand data caps but it is not as popular so it is not supported on as many routers...not sure if yours is on the list. You can also just use port mirroring and then you can use the glasswire program and capture all the data going to the router but again you need a external machine to capture it.

The largest issue I have found with routers lately is the hardware acceleration feature. If you have a highspeed internet connection...say larger that 200m...the router will need to use this acceleration feature to get those speeds. As soon as you start adding fancy data monitoring it goes back to using the main cpu and your transfer rate caps out much lower. Most third party firmware does not even support this acceleration feature.

A router has a very small cpu and even though the router you have is one of the fastest on the market running lots of fancy stuff on the router will impact your performance if you have a fast connection. It would best to avoid using the router to monitor if you have other options.

Is putting in a second internet connection a option. Maybe you could tell the ISP that you and your roommate can't agree on who pays the bill so you each want your own connection. This would double the cap. Technically all you have to do is put a splitter on the cable coming into the house an put a second modem/router on it. It really isn't any different than what the cable company does out on the street to run connections to neighboring houses.

 

[BFG-9000]

The R7000 can use either Tomato or DD-WRT 3rd party firmware that can do this for sure--they can show the bandwidth used by ip address.

As bill001g mentioned, 3rd party firmware generally does everything in software, but so does factory firmware if you are using features like QoS. Bandwidth monitoring will still work but be inaccurate if this hardware acceleration is enabled, because Broadcom FastNAT actually uses the switch chip to do some of the routing, bypassing the router's CPU (and anything bypassed cannot be logged). Nowadays QoS is rather important, especially the fq_codel type which reduces bufferbloat.

If you aren't using QoS, Tomato can actually do the FastNAT half of hardware acceleration with modprobe bcm_nat, but can't do the CTF.ko part so is still slower than factory firmware. So what is your ISP speed?

 

[azaran]

Glasswire Possibly.
https://www.glasswire.com/

https://www.howtogeek.com/222740/how-to-the-monitor-the-bandwidth-and-data-usage-of-individual-devices-on-your-network/

I'll take a look at it tonight and see if I can set it up.

 

[azaran]

If you both agree to monitor your connections it can be done with the above software pretty easy but you must load it on both machines and then manually correlate the information.

Trying to do it with the router is a pain mostly because few routers have any features to collect data like that. If you are lucky they may show current utilization and what machine is active but few have historic information.

You can look at using dd-wrt which give you more options. The one I used to use was dd-wrt version of what cisco calls netflow but you need a external machine to collect the data. The gargoyle firmware is one of the few to understand data caps but it is not as popular so it is not supported on as many routers...not sure if yours is on the list. You can also just use port mirroring and then you can use the glasswire program and capture all the data going to the router but again you need a external machine to capture it.

The largest issue I have found with routers lately is the hardware acceleration feature. If you have a highspeed internet connection...say larger that 200m...the router will need to use this acceleration feature to get those speeds. As soon as you start adding fancy data monitoring it goes back to using the main cpu and your transfer rate caps out much lower. Most third party firmware does not even support this acceleration feature.

A router has a very small cpu and even though the router you have is one of the fastest on the market running lots of fancy stuff on the router will impact your performance if you have a fast connection. It would best to avoid using the router to monitor if you have other options.

Is putting in a second internet connection a option. Maybe you could tell the ISP that you and your roommate can't agree on who pays the bill so you each want your own connection. This would double the cap. Technically all you have to do is put a splitter on the cable coming into the house an put a second modem/router on it. It really isn't any different than what the cable company does out on the street to run connections to neighboring houses.

Thankfully monitoring shouldn't be a problem. Truth is we work really well together as roommates so the issue of setting up monitor software is, well, a non issue. The main concern is seeing if something like a second connection is needed or if we just need to pay more attention to usage and maybe cut back a bit.

 

[azaran]

The R7000 can use either Tomato or DD-WRT 3rd party firmware that can do this for sure--they can show the bandwidth used by ip address.

As bill001g mentioned, 3rd party firmware generally does everything in software, but so does factory firmware if you are using features like QoS. Bandwidth monitoring will still work but be inaccurate if this hardware acceleration is enabled, because Broadcom FastNAT actually uses the switch chip to do some of the routing, bypassing the router's CPU (and anything bypassed cannot be logged). Nowadays QoS is rather important, especially the fq_codel type which reduces bufferbloat.

If you aren't using QoS, Tomato can actually do the FastNAT half of hardware acceleration with modprobe bcm_nat, but can't do the CTF.ko part so is still slower than factory firmware. So what is your ISP speed?

I'm fairly sure I'm not pushing in to the realm of hardware acceleration as you and bill001g mentioned. Right now my service plan is 150Mbps down, 10Mbps up with a 1TB cap for combined up and down. Last I checked QoS wasn't enabled on the router. When I last looked in to it I was seeing a lot of complaints of it doing more harm than good on my specific router so I decided to not much about with it.

 

[azaran]

Slight update. I've setup Glasswire on the 3 PCs in the house and am letting it chug away. Likely will for the next month.

I am curious about playing with the router 3rd party firmwares. But that leads me in to a question for BFG-9000. You said the R7000 should be able to do DDR-WRT but I'm not finding it listed anywhere in their router database. Is it just not officially supported or is there something I'm missing?

 

[BFG-9000]

DD-WRT is a strange animal because the stable "peacock" builds are usually years out of date and you have to search the forums for reports that newer beta builds work, important if you want the latest security patches for DNSmasq and KRACK. They have an instructions page as well as a sticky thread for the R7000. Do not try something that nobody has reported working because it may brick.

Tomato kille72 can be safely updated without worrying that newer versions will brick, a consequence of not trying to support every model under the sun. The author actually has a R7000 so tries it out before uploading them.

Like with most Broadcom devices, even if routing is supported by OpenWRT/LEDE, the Broadcom radios aren't due to the proprietary driver blobs, so no working Wifi. It's also less user-friendly than the other two.