Mikrotik how to check bandwidth usage

Since at&t recently announced monthly bandwidth caps, I figured I would try to setup something to monitor my monthly bandwidth. Preferably I would like to monitor at the pppoe interface, or possibly my dhcp server interface. I haven't found a way to do this. I already have queues setup for all the devices in house with sticky statics. I would use the queue to monitor the bandwidth, but they seem wrong sometimes, and I am going through a wireless AP so I dunno how much overhead that adds. So, what I am looking for is a way to measure inbound and outbound traffic on 1 interface of my router for a period of time. Thanks!

edit: all systems behind the router are either windows or devices like iPod, blu-ray player, etc. I do have access to an Ubuntu Linux vps so I could set something up in Linux if it could be done remotely.

Mikrotik Live bandwidth usage graph

Implemented in the release of Splynx version 3.0, now there is a feature called "Live bandwidth usage", which can be used in conjunction with Mikrotik devices.

Requirements:

1. Radius authorization required;
2. API should be configured and enabled for the router;
3. NAS Type supported: Mikrotik only;
4. Mikrotik RouterOS should be updated to a version later than 6.43;
5. PPP connection. DHCP leases are not acceptable.

Navigate to Networking → Routers → List, click on the edit button of the desired router to configure and select the "Mikrotik" tab.

API should be configured and enabled, API status should be "OK" and clicking on the “Test API connection” button, should return Successfully.

Click on the "Live Bandwidth usage" button to view per-interface graphs of the router:

If the graph is available on the router, a customer who is connected to this router will also have this graph under their Statistic tab:

Navigate to customer's "Statistics" tab:

If there’s no usage on the line, the graph will not populate any data.

NOTE! If the graph is available on the router but not for a customer. You can run the following command on your server, via SSH:

sudo service splynx_node restart

If after the restart of this module, the graph for the customer is still not available, please create a ticket to us so we can investigate the issue.

Another reason for this could be that the authentication is set to API and only Radius authentication will provide these graphs.

How to use your MikroTik router to see exactly who or what is using your Internet bandwidth.

The Problem

I use my Internet for VoIP calls. Either for my work or my home phone.

But if a device is using excessive bandwidth, the call quality drops from “very good” to “totally unusable”.

So, I need to track down what is using my bandwidth and disable / pause it.

What Device?

Mikrotik routers are pretty fantastic devices.

We’ll use two features to track down where my bandwidth is being used: interfaces and torch.

These steps assume you’re using WinBox, and have already logged in to your Mikrotik based gateway.

Interfaces

First up is to identify bandwidth usage at a high level. Click Interfaces from the top-level menu (top left).

You’ll see a list of all interfaces on your router. Which will include physical ports, WiFi interfaces (physical or virtual) and other interfaces including your PPPoE connection and LTE / 3G modems.

Check your internet interface (usually PPPoE, or maybe LTE / 3G) to see how much bandwidth is currently being used. You’ll need to already know your connection limits / capacity in advance, as Microtik won’t tell you that.

Mine is using around 4Mbps downstream (Rx = receive) and 120kbps upstream (Tx = transmit).

(And yes, 4MBps is 90% of my downstream capacity. Yay for my ultra fast ADSL connection - and being about as far from the telephone exchange as I can possibly be).

On the good side, I’m only using about 20% of my upstream capacity, so VoIP calls should be mostly OK. But something is using all my download capacity. So lets drill in further to find out what.

Torch

Our gut reaction is to drill into the Internet interface. This is actually wrong, but does get us closer to pointing fingers. So we’ll start by doing the obvious and I’ll show where we went wrong and how to fix it in a moment.

Double click your Internet interface and click Torch (bottom right). You should see a list of real-time traffic appear. Sort by Rx Rate or Tx Rate so the offending IP addresses are listed at the top.

UPDATE 2017-08-13

IMPORTANT: If you are using the “webfig” web interface via a browser, you must tick the boxes to collect information about protocol and port. If you don’t do this, you’ll see all IP addresses as 0.0.0.0. If you still find trouble getting torch working in webfig, please use WinBox instead.

END UPDATE

I have two IP addresses to look into: 150.101.98.69 and 23.7.19.36. Between them, they are using almost all my 4Mbps. So more information about these IP addresses will help.

Unfortunately, the destination column (dst) is all the same 150.101.201.180. Which I happen to know if my public IPv4 address. And this does not help us work out what local device is using bandwidth.

And this was our slight mistake before: drilling into the internet interface was not quite right. We should have drilled into the bridge interface.

Fortunately, that is easy to fix: just change the Interface drop down in the top left to your bridge interface.

You’ll notice that everything is backwards (src and dest, Rx and Tx just swapped), but that’s OK. Its just looking at things from the bridge’s point of view.

Now we’re in business! We’ve got internal and external IP addresses, sorted by usage.

Address Lookups

I happen to know that 192.168.25.100 is my laptop and 192.168.25.20 is my media server, so now I can start looking more closely in the next section. But first, lets gather some more information about the external addresses.

I used nslookup on my windows laptop to get more information about the top 3 IP addresses:

You can also cross check and get more information by doing a Who Is lookup on the IPs. I like using APNIC’s Who Is service; less ads than the commercial services.

Akamai Technologies is a content distribution network (or CDN), which means we’re downloading something (thank you captain obvious!).

Netstat

To get more information from my laptop, I used netstat -n -b (on Windows, you’ll need an elevated command prompt for netstat’s -b option). This lists all open network connections and the process using them.

After a bit of digging, I found the IP address in question. And the process that was listed against it was chrome.exe.

In fact, Chrome was listed several times for that IP address.

Chrome has a lovely All Downloads list, which (strangely enough) lists everything its currently downloading.

Oh, that right! I’d just starting downloading a whole bunch of videos from Build 2016.

(And yes, I started downloading them to illustrate this how-to. It’s always helps to know the answer before you start!)

Something Much Harder

Here are three screenshots from the first time I used torch. It took a while, but I narrowed down to downloading the Windows 10 install packages.

It was made much harder to diagnose because Windows didn’t ask me in advance (or provide any other indication it was downloading) and there was nothing special about the IPv6 address listed (Windows was using its new peer-to-peer update function).

There was considerably more guess work involved in that case!

Conclusion

You can use the torch function on Mikrotik routers to identify what local device is using bandwidth, and make a reasonable guess as to what external service its using. And from there, use local tools to further identify exactly what program is responsible.

How do I check bandwidth utilization?

How can I monitor my mikrotik internet usage?

How do I check the bandwidth of my router?

How can I tell which IP address is using more bandwidth?