# Monitor Internet usage (excluding local subnet usage)



## woodsb02 (Sep 30, 2014)

Something has used up all of our Internet download quota, and my FreeBSD home-theater-pc has been accused. It has a single wifi NIC (iwn0 with wlan0 alias) which is connected to our local subnet with any internet traffic routed through 192.168.1.1. It has IP 192.168.1.3 and a jail has IP 192.168.1.99.

I can see that the computer has received 6Gb of data on the wlan0 interface:

```
#netstat -i -b -n -h

Name    Mtu Network       Address              Ipkts Ierrs Idrop     Ibytes    Opkts Oerrs     Obytes  Coll
re0*   1500 <Link#1>      00:01:2e:48:eb:8d        0     0     0          0        0     0          0     0
iwn0   2290 <Link#2>      b8:03:05:dd:ae:37        0     0     0          0     298K  3.2K       216M     0
lo0   16384 <Link#3>                            428K     0     0       3.1G     424K     0       3.1G     0
lo0   16384 ::1/128       ::1                      2     -     -        140        2     -        140     -
lo0   16384 fe80::1%lo0/6 fe80::1                  0     -     -          0        0     -          0     -
lo0   16384 127.0.0.0/8   127.0.0.1                2     -     -        100     424K     -       3.1G     -
wlan0  1500 <Link#4>      b8:03:05:dd:ae:37     4.5M    43     0       2.1G     1.4M     0          0     0
wlan0  1500 192.168.1.0/2 192.168.1.2           1.6M     -     -       1.6G     1.3M     -       156M     -
wlan0  1500 192.168.1.99/ 192.168.1.99          2.3K     -     -       2.0M        0     -          0     -
wlan0  1500 192.168.1.3/3 192.168.1.3           769K     -     -       3.2G        0     -          0     -
```

The issue is, I can't determine how much of the received data is from the local subnet, and how much is from the Internet. Is there an easy way to setup logging so I can see how much data comes from each?

If I can determine it is downloading too much data, the next thing I will be searching for is which running process is doing the downloading. I can see it is easy enough to view live connections using iftop and historial per-IP connections using darkstat... but I have not yet found a way to record per-process usage, as per nethogs on Linux. http://unix.stackexchange.com/quest...rmance-for-each-application-in-freebsd-pc-bsd

Any ideas?


----------



## woodsb02 (Sep 30, 2014)

Sorry, the host has IP 192.168.1.2, and there are two jails, with IPs 192.168.1.3 and 192.168.1.99.


----------



## woodsb02 (Sep 30, 2014)

Hmm... looking at it again, I think the answer of Internet usage might be in that netstat output.
Can someone please tell me if I have interpretted the netstat output correctly below:


```
iwn0   2290 <Link#2>      b8:03:05:dd:ae:37        0     0     0          0     298K  3.2K       216M     0
```
This is network traffic which doesn't use the wlan0 alias... not sure what this would be since all routes use wlan0 (none use iwn0).


```
wlan0  1500 <Link#4>      b8:03:05:dd:ae:37     4.5M    43     0       2.1G     1.4M     0          0     0
```
This is network traffic which came to my mac address directly from the local subnet (not routed from Internet).


```
wlan0  1500 192.168.1.0/2 192.168.1.2           1.6M     -     -       1.6G     1.3M     -       156M     -
```
This is network traffic from 192.168.1.1 to my IP address. This would be routed traffic (i.e. from the Internet).


```
wlan0  1500 192.168.1.99/ 192.168.1.99          2.3K     -     -       2.0M        0     -          0     -
```
The is network traffic from my jail. This would be localhost traffic from jail to host.


```
wlan0  1500 192.168.1.3/3 192.168.1.3           769K     -     -       3.2G        0     -          0     -
```
This is network traffic from my jail. This would be localhost traffic from jail to host.

Does that mean it only used 1.6G of Internet usage?


----------

