Tracking Bandwidth Usage per IP (Home)

[fdlucas]

I want to be able to track my bandwidth usage per IP or MAC. I have thought about using PFsense, VyOS using GIGABYTE GA-J1900N-D3V Mini ITX with 4 gigs of memory and a sata hard drive. But I just recently read posts on other forums that said Tomato or Merlin on a router would be better (due to asics). What would you guys recommend.

 

[bill001g]

Asic can't do that function they are designed to do special purpose functions like switching or encryption.

The processors and memory are extremely limited on a router so there are few if any function that would run better on a cheap consumer router than a general purpose computer.

You key problem with any router is they have no place to store data. Even if all you do is collect the raw data you still need to process it and produce meaningful reports. Its not like you could say take a months worth of data and generate a summary report in a reasonable time with a router cpu.

The function a router can do well is tell you at a particular instant what is currently active because it has it all in its memory.

 

[fdlucas]

Yeah Bill, I was a bit more concise than accurate there. The forums I was reading stated that the PC version routers can't keep as high of throughput as the ASIC type Routers. They also stated that Tomato or Merlin running on a router will give you the ability to monitor per IP. As in this forum here.... http://forums.smallnetbuilder.com/showthread.php?t=9013

 

[bill001g]

The ability to monitor is pretty much the same. In most cases it is just a variant of the same exact program. The key issue is getting to the data in the first place. If you have a inline firewall/router running of a PC it really isn't any different than a router. What really is the difference between a router cpu running a linux variant called tomato or a pc loaded with the kali linux variant that has every hacking/network tool preloaded.

The key problem is there is no place to store the data on a router in most cases if you reboot the router you lose all the data. Sure you can store it to flash on some routers but feeding thought the USB eats even more of the limited CPU.

If you have the option to use a actual PC you will have many more options. The key is you must be able to get into the data path.

The way this is commonly done commercially, and dd-wrt/tomato have some support, is to let the router perform the basic capture/summary and then send it to a external server to process. This way when you have 100 routers you can still run your reports from one machine rather than having to log in. The tool that is used to do what you discus is generically called netflow but there are a couple of variants. This is mostly used to see what is running historically active monitor is usually done with SNMP based tools probing the router for information.

 

[fdlucas]

The ability to monitor is pretty much the same. In most cases it is just a variant of the same exact program. The key issue is getting to the data in the first place. If you have a inline firewall/router running of a PC it really isn't any different than a router. What really is the difference between a router cpu running a linux variant called tomato or a pc loaded with the kali linux variant that has every hacking/network tool preloaded.

The key problem is there is no place to store the data on a router in most cases if you reboot the router you lose all the data. Sure you can store it to flash on some routers but feeding thought the USB eats even more of the limited CPU.

If you have the option to use a actual PC you will have many more options. The key is you must be able to get into the data path.

The way this is commonly done commercially, and dd-wrt/tomato have some support, is to let the router perform the basic capture/summary and then send it to a external server to process. This way when you have 100 routers you can still run your reports from one machine rather than having to log in. The tool that is used to do what you discus is generically called netflow but there are a couple of variants. This is mostly used to see what is running historically active monitor is usually done with SNMP based tools probing the router for information.

Awesome, thanks bill