Depends on what you mean by "monitor". That could be everything from noticing a spike in activity levels from one machine, to tracking all of someone's traffic, in varying degrees of detail. Unfortunately, your typical consumer router offers neither. I have a dd-wrt (third party firmware) router and can monitor traffic at least to some degree.
If you’re up to the challenge, you could try Wireshark. It’s a pretty complex tool, but in the right hands, there’s almost nothing it can’t tell you about what’s happening on your network. And it’s free.
The other option (assuming it’s strictly a wireless bandwidth issue) is to patch a second wireless AP to the router (obviously using a different channel), keeping your family and him separated. You can convert any wireless router into a wireless AP for these purposes (you may already have one lying around). Of course, this does nothing to solve the problem of him hogging your internet bandwidth, but it’s not clear if that’s part of the problem too.
Come to think of it, some consumer routers (and dd-wrt) support a “guest SSID” that only permits internet access. So if protection also means keeping him off the rest of your local network, that would be one way to do it.