I have an EdgeRouter PoE router which runs EdgeOS (Vyatta based). I'd like to monitor bandwidth usage by host. My goal is to get a list of total downloads/uploads by host.

It's not important to me whether the solution runs directly on the router or on a workstation in the same network.

I've tried several SNMP apps that give me a total for the entire network, but I'd like to break it down by host.


Realize this was asked about a year ago, but Ubiquiti added DPI (deep packet inspection) to the EdgeRouter line of products recently (for free) in the firmware v1.7.0 release. Firmware v.1.8 (currently in beta) will offer DPI for all traffic, where v1.7 only handled traffic that was hardware offloaded. Setting can be enabled fully and does application layer analysis, or host only mode.


| improve this answer | |
  • Indeed... the admin now has a UI to report on this data. – 0x6A75616E Oct 11 '15 at 4:40

There are two options.
1) Netflow as suggested by Teftin or 2) Analyze the traffic stream

To implement option #2, you need either:

a. Network tap - more hardware but no performance impact to router. Some taps will provide two traffic streams (think ethernet TX pin in each direction). The two streams need to be bonded in the analysis device.

b. Mirror (or span) port on the router if supported - will consume some router resources. No bonding needed.

Then you need an analysis device to analyze the traffic stream. Depending on your needs & budget, consider using an old laptop/workstation running:

ntopng - web-based UI, has some historical info

pktstat - command-line tool, real-time, no history

wireshark - has a 'conversations' view - not ideal for long-term use

tshark - has an option -z conv,type[,filter] which displays conversations after tshark stops

Two other tools that I have not used but look promising are:



If you really want all the messy details, check-out the 'Network Monitoring vs. Network Insight' whitepaper I wrote at protectus.com. (Full disclosure, I work there.)

| improve this answer | |

In general, usual way of achieving this kind of monitoring is using netflow. This will require:

  • netflow collector running on separate server (for instance ntopng + nprobe)
  • router has to be configured to export the flow information
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.