How do I log traffic through my network?

jennyb527

Reputable
Feb 25, 2015
1
0
4,510
We have a home business out in the boonies, and we're on Dish for our internet. We had the 10Gb monthly package, but it just wasn't enough so we upgraded to the 15Gb package. This month we used the entire package in 10 days (really unusual) and then have had to purchase 5 'tokens' which a 1Gb each. The other day the secretary purchased a token, and with no internet use other than e-mail for the rest of the day (no large attachments) .8 of the Gb had been used by 5pm.

I'm suspicious that there is an iphone, ipad, laptop... something... on the network that is using the data either without the user realizing it, or without the user admitting it (grandkids?!).

At this point I don't need to specifically log what traffic is going across the network (ie keylogger, etc) although I guess it could come to that. What I need is some sort of catch-all that would monitor the traffic from the devices on the network, so that I can see what device the high data use is coming from.

We have a NetGear N600 that is password protected. Someone else using is isn't a possibility, because we are literally a mile from any other structures. There are 3 PC's (2 are hardwired to it), 2 laptops in residence and 2 that are in and out on occasion, 1 iPad, and can be up to 4 smart phones (depending on the day/time).

Any suggestions for a good way to monitor traffic would be appreciated!
 
Solution
A few things worth checking:
  • ■Auto-upload of photos on the phones.
    ■Auto sync, e.g. Dropbox, Google Drive, MS OneDrive.
    ■Someone watching lots of youtube, or gaming.
    ■OS patches?

Some devices, particularly recent Android phones, have the ability to show how much data they used and what app it was. There's normally a tickbox to include WiFi data in the totals.
No easy way.

The only device that actually knows this information is the router and it has extremely limited abilities. You can use keyword blocking and then there is a log option but you basically have to sit and watch it since it only has so many entries and all it really is a list of web sites. I don't think it monitors non web traffic....ie I don't think it would see many forms of stream video.

If you are ambitious you can load third party firmware. The best one to try is going to be gargoyle. Normally I don't recommend that one since it has a much smaller user base and not as many routers supported. Your router is supported on openwrt which means it likely is support on gargoyle. The only reason I like this one in your case is it only one I know that has the ability to monitor and enforce bandwidth caps. It has menus designed to let you see utilization by device in your house.

Other firmware versions like the more popular dd-wrt or tomato or open-wrt will likely also work but they do not include nice gui menus. In most cases you will have to get into the unix commands these firmware releases are based on. There are many options to log traffic you would just have to pick which you prefer. In most cases you would collect the data on the router and then export it to a pc. If you have used a unix systems before at the command line level it is not real hard but it is quite a lot to learn if you have never done it before.

The only other way to get the data is to insert something between the router and your modem. You would put in a tap or a switch that has mirror ability and directly capture the traffic with a pc running wireshark. You could also put a dual nic pc running as a firewall. The main downside to this is the traffic has already passed though the nat so all traffic appears to come from the router. You would know what the traffic was but would not know for sure who did it.
 
A few things worth checking:
  • ■Auto-upload of photos on the phones.
    ■Auto sync, e.g. Dropbox, Google Drive, MS OneDrive.
    ■Someone watching lots of youtube, or gaming.
    ■OS patches?

Some devices, particularly recent Android phones, have the ability to show how much data they used and what app it was. There's normally a tickbox to include WiFi data in the totals.
 
Solution