How to see which connection uses bandwith

Is there a way to see which connection uses the most bandwith? In Status → Connections I see all connections, which is great. But to find out which connections uses a lot bandwith seems hard to me. Somehow a sorting feature for Data Transfer would be great.

Or do I overlook something?

Similar topics have been discussed on the forum.
I hope you find the guidance you need.

https://community.ipfire.org/t/network-monitoring-on-each-interfaces

https://community.ipfire.org/t/finding-who-generates-traffic

https://community.ipfire.org/t/traffic-graphs-from-green

Regards

Hallo @diver

Welcome to the IPFire community.

The following addon might help.
https://www.ipfire.org/docs/addons/pmacct

HI all,
currently not sure if someone wants to check it https://github.com/ummeegge/IPFire-Pmacct-Web-Interface since it is under development and it currently works only with the memory plugin (standard after Pakfire installation) .

Current key features:

  • Live view of the biggest bandwidth consumers (Bytes columns are like the others sortable, one click in the header needed)
  • IPFire zone coloring (Green/Blue/Orange/Red + OpenVPN/WireGuard) like in connections.cgi
  • Clickable IPs → opens ipinfo.cgi in a new tab like in firewall CGIs
  • Search, column filtering, client-side sorting, pagination, CSV export
  • Supports multiple memory plugins (dropdown selection)
  • 5-second live refresh per default but configurable (to off, 2, 5 and 10)
  • No extra packages required

If someone wants to give it a try/test, feel free to do so and feedback for bugs and new ideas might be nice :slight_smile: .

This sound interesting. I will test it out soon I hope.

No problem, just do what you can or want :slight_smile:
I haven’t had the time to write a more detailed README.md, but if you’d like to get a deeper insight, you can find some more information here: ummeegge/IPFire-Pmacct-Web-Interface | DeepWiki (not written by me but i like it :wink: ).

Best,

Erik

Hi, I tried installing the component on a test machine.
One thing I noticed is that it only shows traffic on the green and red networks, not the blue ones.
What did I do wrong?

Hi @tratru,
great question :slight_smile:

The pmacct.conf did it and pmacct.cgi expects it like this:
https://git.ipfire.org/?p=ipfire-2.x.git;a=blob;f=config/pmacct/pmacct.conf;h=79e3fd6a74460bed55faf0672291553566efd8ae;hb=refs/heads/core198

The default configuration after a Pakfire install is here (green0):
https://git.ipfire.org/?p=ipfire-2.x.git;a=blob;f=config/pmacct/pmacct.conf;h=79e3fd6a74460bed55faf0672291553566efd8ae;hb=refs/heads/core198#l11

therefor you see what you see. To answer a potential next question in advance :wink: — yes, it’s possible to get more interfaces with pmacctd, but you’ll need to set up an appropriate interfaces.map file. In addition, a suitable CGI script would need to be created to handle it. :slight_smile: .

Best,

Erik

Can this be used in combination of the DNS as well? Because destination IPs won’t tell you what kind of “service” had been used., if it’s an AWS server etc.

Hi, I haven’t checked it thoroughly yet, but by making this change, I was able to have both the network and Blu at the same time.
I modified the pmacct.conf file.
The string to change is this:
pcap_interfaces_map: /etc/pmacct/interfaces.map

I added a new file in the same directory called interfaces.map
with these instructions:
ifname=green0 ifindex=100 direction=in
ifname=blue0 ifindex=101 direction=in

Hi all,

made a fast one with libloc and the “AS name” and the country flag. May this fit your needs too ? It looks currently like this

Great news @tratru will give it a try after the weekend with a little more time :slight_smile: .

Some changes has been made and all has been pusht to the repo.

Best,

Erik

Hello @diver / Silvan

Welcome to the community !

Personally, I use SARG (Squid Analysis Report Generator) and I wouldn’t change it. Its interface might be a bit dated, but I find it very user-friendly and the information it provides is truly relevant.

The information gathered : Top sites, Sites & users, Downloads, all sorted by IP address (it’s just missing the associated name of the machine concerned and it would be perfect).

Sadly no. My intent is to detect any “illegal” use of services, such as video streaming of my kids, that may cause me trouble. Therefore it will be great to log the device (source), the destination (URL) and the amount of traffic (for example per day).

Hi, I stumbled across this topic and wanted to create a nice overview for myself, but unfortunately it doesn’t seem to work that easy way.
I downloaded the package via Pakfire and loaded the configuration you linked here and installed it with the three specified commands.
Unfortunately, the module does not start, or at least I do not get an overview page displayed. Neither in the web GUI nor when entering the link manually.

Did I miss sonething or have to configure any file?

Greetz

P.s.

Happy new year to the community :smiley:

Hi @mumpitz and all a happy new year :slight_smile: .
It might be an idea to use a new topic for this since i do not want to take this one over. May there are also other ideas from others which match the topic owner´s needs better then mine.

Best,

Erik

There are ways outside of IPFire that you could get this information. One example is using a TP-Link access point along with the Omada controller software. This gets you everything you need as long as the devices you want this information on are wireless. One thing this will NOT do is tell you which sites have been visited, but you did not ask that in your original post.

Here is a screenshot of one of the wireless devices on my network.

Here is another with a more normal usage profile. You can see when the TV was on and when it was off, as well as a bandwidth graph for when it was on.