Monitor Internet usage (excluding local subnet usage)

woodsb02

woodsb02

Something has used up all of our Internet download quota, and my FreeBSD home-theater-pc has been accused. It has a single wifi NIC (iwn0 with wlan0 alias) which is connected to our local subnet with any internet traffic routed through 192.168.1.1. It has IP 192.168.1.3 and a jail has IP 192.168.1.99.

I can see that the computer has received 6Gb of data on the wlan0 interface:
Code: 
#netstat -i -b -n -h

Name    Mtu Network       Address              Ipkts Ierrs Idrop     Ibytes    Opkts Oerrs     Obytes  Coll
re0*   1500 <Link#1>      00:01:2e:48:eb:8d        0     0     0          0        0     0          0     0
iwn0   2290 <Link#2>      b8:03:05:dd:ae:37        0     0     0          0     298K  3.2K       216M     0
lo0   16384 <Link#3>                            428K     0     0       3.1G     424K     0       3.1G     0
lo0   16384 ::1/128       ::1                      2     -     -        140        2     -        140     -
lo0   16384 fe80::1%lo0/6 fe80::1                  0     -     -          0        0     -          0     -
lo0   16384 127.0.0.0/8   127.0.0.1                2     -     -        100     424K     -       3.1G     -
wlan0  1500 <Link#4>      b8:03:05:dd:ae:37     4.5M    43     0       2.1G     1.4M     0          0     0
wlan0  1500 192.168.1.0/2 192.168.1.2           1.6M     -     -       1.6G     1.3M     -       156M     -
wlan0  1500 192.168.1.99/ 192.168.1.99          2.3K     -     -       2.0M        0     -          0     -
wlan0  1500 192.168.1.3/3 192.168.1.3           769K     -     -       3.2G        0     -          0     -

The issue is, I can't determine how much of the received data is from the local subnet, and how much is from the Internet. Is there an easy way to setup logging so I can see how much data comes from each?

If I can determine it is downloading too much data, the next thing I will be searching for is which running process is doing the downloading. I can see it is easy enough to view live connections using iftop and historial per-IP connections using darkstat... but I have not yet found a way to record per-process usage, as per nethogs on Linux. http://unix.stackexchange.com/quest...rmance-for-each-application-in-freebsd-pc-bsd

Any ideas?
 
Sorry, the host has IP 192.168.1.2, and there are two jails, with IPs 192.168.1.3 and 192.168.1.99.
 
Hmm... looking at it again, I think the answer of Internet usage might be in that netstat output.
Can someone please tell me if I have interpretted the netstat output correctly below:

Code: 
iwn0   2290 <Link#2>      b8:03:05:dd:ae:37        0     0     0          0     298K  3.2K       216M     0
This is network traffic which doesn't use the wlan0 alias... not sure what this would be since all routes use wlan0 (none use iwn0).

Code: 
wlan0  1500 <Link#4>      b8:03:05:dd:ae:37     4.5M    43     0       2.1G     1.4M     0          0     0
This is network traffic which came to my mac address directly from the local subnet (not routed from Internet).

Code: 
wlan0  1500 192.168.1.0/2 192.168.1.2           1.6M     -     -       1.6G     1.3M     -       156M     -
This is network traffic from 192.168.1.1 to my IP address. This would be routed traffic (i.e. from the Internet).

Code: 
wlan0  1500 192.168.1.99/ 192.168.1.99          2.3K     -     -       2.0M        0     -          0     -
The is network traffic from my jail. This would be localhost traffic from jail to host.

Code: 
wlan0  1500 192.168.1.3/3 192.168.1.3           769K     -     -       3.2G        0     -          0     -
This is network traffic from my jail. This would be localhost traffic from jail to host.

Does that mean it only used 1.6G of Internet usage?
 
You must log in or register to reply here.
Back
Top