Data Usage Reports

[ukchris]

Hello! I am currently running DD-WRT as a router with wireless disabled and an ORBI mesh for wifi. I am trying to get a deeper view of data usage in terms of clients, apps and what sites/targets they are using, while the Traffic Monitor is nice I couldn't get YAMON working and was recommended Gargoyle.

I think I have a TP-WR1043ND somewhere I'd load it on, I would disable wireless and look to use it just as a router - I cannot however seem to find examples of reports, charts etc of monitoring capabilities. Am I missing something?

I realize Gargoyle provides a much broader feature set and as such it's completely reasonable that those feature need a lot of documentation - is there anywhere I can get a deeper understanding of reporting capabilities in Gargoyle?

Thanks, Chris.

[ukchris]

One more quick question, for a TP-1043ND-V2.X the install guide says to use Atheros AR71XX Branch 1.6, when I go to download it's up to 1.12, should I go with 1.6 or assume newer is better?

[Lantis]

https://www.gargoyle-router.com/screenshots.php
Do these screenshots help?

You should run the latest where possible.

[ukchris]

I did look through the screenshots but didn't see anything at the level of detail I was hoping for. I have installed Gargoyle but cannot switch over until later (home schooling, work from home) to see what level of data I get and how it compares to what I am getting in DD-WRT. I was hesitant to switch without feeling confident but I guess I'll have to try it and see!

As for versions... I installed 1.6 as the instructions specifically said to, are you saying I should/could use 1.12?

[Lantis]

Yes you should run the latest version.
For an internet facing device, and a device exposing a wifi network, these are particularly important as several vulnerabilities have been fixed over the years.

[ukchris]

Thanks I upgraded to 1.12, I have now had Gargoyle running for a few hours and wanted to see if I could get some clarification on bandwidth tracking. I see the charts which are cool, I can add a second and third plot so see specific devices, also very cool, questions....

1. If I "Download Bandwidth Data" I get a CSV file where some lines are similar to this: download,2,449,COMBINED,1612892890,1612892892,940117 where is says COMBINED
a) What does it mean when it has COMBINED instead of an IP?
b) Is it possible to get host names instead of IPs? I assume I could do a lookup but if the DHCP leases change wouldn't it be off?
c) What are the 5th and 6th columns? Some form of date time?

2. Is there somewhere I can enter a friendlier host name for reference against mac address or IP?

Thanks for all of your help, very much appreciate it.

Chris.

[Lantis]

Combined = all traffic regardless of IP
You can't get hostnames directly in that report, you would need to make a lookup.
Yes those are timestamps in epoch format
Yes it is recommended to set static leases under Connection -> DHCP, not only for bandwidth monitoring but also to make QoS, quotas, restrictions etc easier to manage. This also solves your lookup issue for bandwidth IPs that you pointed out.

[ukchris]

"Combined = all traffic regardless of IP" - does that mean these are aggregates or is it a lot of low usage IP's rolled up into one?

If I want to generate details of bandwidth used by IP address would I simply exclude the "COMBINED" rows? After 3-4 hours running I have over 50,000 rows in the download so I'm trying to work out how best to query it to do some analysis.

Careful what I wish for, I wanted granularity and I certainly got it..!

[Lantis]

It's an aggregate for the whole link.
So yes if you just want to know what an individual device is doing, don't look at combined.

The data is different levels of granularity.
You can see the last 15 minutes in 2 second intervals.
Then it is 24 hours in minute intervals.
Then 31 days in hour intervals.
1 year in 1 day intervals.

This is from memory I might have a few of the intervals mixed up.
When you download the data you'll get all of these at once.
In the example you posted before, which was "download,2,449", the 2 means interval (2 seconds), and the 449 is how many records are kept. Multiplying that out gives you 15 minutes.

[ukchris]

Got it, thanks, I’ll let it log for a day or so then do some deeper analysis of what I can see t different levels of aggregation. If it feels insightful I’ll report back in case it’s useful for others.