How to figure out which machine on LAN is using bandwidth?

Discussion in 'Tomato Firmware' started by JustinChase, Jan 17, 2014.

  1. JustinChase

    JustinChase Networkin' Nut Member

    I'm using the Toastman build, and using the QoS settings, with few modifications. Pretty happy with the results.

    I'm not sure if this is a Toastman build issue, or a Tomato issue (I suspect it's with Tomato), but when I'm looking at the QoS graph view, I can see that WWW is using about 3500 kbits/s. Sadly, I'm not sure which machines are actually using that bandwidth. If I click on the WWW hyperlink, it brings me to the Details, showing 24 connections, and lists the IP addresses involved.

    This information is rather useless to me, as far as I can tell. It lists the Source IP, which is where the traffic is coming from. In my case, about 1/2 these IP addresses seem to be Google, which seems strange/bad. The Destination IP shown for almost every line is, which is the router. Everyone is connected via wifi, so they all get routed thru this IP, meaning I have no idea which machine(s) is actually using the bandwidth.

    It seems like the router should know which internal IP has requested data, and could/should show me the local IP for any/all data streams. Showing everything with the same IP is not much more useful than showing nothing at all.

    Am I doing it wrong, is there another place to find this information, or can this be changed in software to show better detail here?
  2. Malitiacurt

    Malitiacurt Networkin' Nut Member

    IPTraffic monitor.
    Marcel Tunks likes this.
  3. mvsgeek

    mvsgeek LI Guru Member

    Something is not right. Which release of Toastman? What is the make/model of your router?
    From the QoS "View Graphs" page, clicking on either the relevant slice of the pie chart or the corresponding hyperlink should take you to the "Details" page, where the Source IP should show a breakdown by internal LAN address (Google should definitely not appear in this column). Here's a sample of what I'm seeing - the Source IP's can then be identified from the Device List page :

    View Details: WWW (42 connections)
    Proto Source S Port Destination D Port Class Rule Bytes Out Bytes In
    TCP192.168.1.124 42158 443 WWW 28260216
    TCP192.168.1.1955475417.172.232.110443WWW2814.62 KB15.21 KB
    TCP192.168.1.1685355367.148.153.13680WWW2926.03 KB25.98 KB

    Oops sorry for the crappy formatting, I'm still trying to figure out how to post screen captures.
    Last edited: Jan 17, 2014
  4. darkknight93

    darkknight93 Networkin' Nut Member

    You could install entware and package iftop to.monitor bandwidth usage for your router
  5. JustinChase

    JustinChase Networkin' Nut Member

    That's probably beyond my skill level at this point :(
    Last edited: Jan 18, 2014
  6. JustinChase

    JustinChase Networkin' Nut Member

    I thought I had notification turned on for this topic, but it seems not; so I just saw the replies.

    Attached is what I'm seeing. The IP address with the "most" use was, and it seems to be a Google IP.

    I'm using this router...

    Model Linksys E3000
    Chipset Broadcom BCM4716 chip rev 1 pkg 10
    CPU Freq 480 MHz
    Flash RAM Size 8 MB

    and this firmware...

    Tomato Firmware v1.28.7503 MIPSR2Toastman-RT K26 USB VLAN-VPN-NOCAT

    Thanks for the help.

    Attached Files:

    Last edited: Jan 18, 2014
  7. Marcel Tunks

    Marcel Tunks Networkin' Nut Member

    What does the ip traffic monitor show?
  8. JustinChase

    JustinChase Networkin' Nut Member

    That's how I ended up figuring it out, but it's too much 'guesswork' to get the answer. I had to click on all the connections to see which one had traffic. Details attached.

    Attached Files:

  9. Marcel Tunks

    Marcel Tunks Networkin' Nut Member

    QoS > Transfer Rates summarizes it in a different way, showing bandwidth usage with ip addresses and traffic type. If you don't have too many devices then it can be useful. It doesn't add up all the traffic for a total from each ip, but it can help you to track down a misbehaving device or user. It's complementary to the ip traffic monitor.
  10. JustinChase

    JustinChase Networkin' Nut Member

    Neither of those (traffic monitor and transfer rates) is very easy to find usage by device, unfortunately.

    I can't see any benefit to the Details screen showing me all the bandwidth coming from the router, instead of the client connected via wifi. Changing this to show the originating client/device is MUCH more useful than everything showing the same IP, which really tells you nothing.

    Perhaps one day it can be changed.
  11. mvsgeek

    mvsgeek LI Guru Member

    Attached screen shot is the top of my Details screen, sorted in descending "Bytes in" order. I believe it's what you're looking for. Something in your environment must not be working as intended. I see you have multiple subnets, how many routers have QoS enabled? QoS operates only on the WAN port.

    See my sig for h/w & f/w details - I'm running the 7483.2 Toastman release for WDS reliability. It doesn't have the latest QoS with enhanced inbound capability so my QoS rules are based on Toastman's tutorial using outbound bandwidth only. Perhaps you could also try an older Toastman version?

    Attached Files:

  12. JustinChase

    JustinChase Networkin' Nut Member

    Your screenshot is what I expected to see, but obviously don't.

    I may very well have things "messed up" in my settings, I struggled to get everything working* (I thought). I'll try an older version, but since I have to re-learn/remember how to 'backup' all my settings before I start over, I will have to put this off for a while. I'm going out of town Monday, and have too many other things to work on now.

    Thanks for the help. I'll eventually report back what I find.

    *That link should show all settings I changed from "stock".
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice