RBR40 and RBS40 wifi - Wishing to capture/monitor traffic/BW usage of connected wifi devices

Question

Hello&nbsp;
Have had this model RBR40 RBS40 of Orbi for some time and am very &nbsp;happy with its performance once I installed two corresponding satellite units. I am keen to capture the usage of each &nbsp;wifi device connected to the Orbi base unit and the satellites. The Orbi base unit is set up as an AP. Ahead of the Orbi is a VDSL modem connected to the Internet. The VDSL modem provides the DHCP server for all &nbsp;wired and wireless (wifi) connected devices on the LAN. &nbsp;I note from looking at the ip table in the VDSL modem that all three &nbsp;Orbi’s are assigned an individual IP address as expected. When I log into the individual &nbsp;Orbi’s I can see the individual connected devices IP address but when I log into the VDSL modem I can only see the respective Orbi Ip addresses not the connected devices. My plan was to insert a monitoring &nbsp;device to enable wireshark to capture all traffic. But I am guessing the Orbi NAT’s will not allow me to capture the wifi devices individually and since being a consumer product there will not be the option to disable the NAT.
i appreciate advice on what alternatives/ possible options I have to capture the individual wifi devices consumption “behind” the Orbi’s. I presume reconfiguring the network to change the role of the Orbi to a router rather than an an AP won’t help because the NAT remains. Any help appreciated since I wish to avoid replacing the Orbi’s. Chris
&nbsp;

CrimpOn · Answer

Furrye38 asked the right question: what is the make and model of the modem you are connected to?
&nbsp;
Something in your analysis may not be correct.&nbsp; If the Orbi is in AP mode and the modem is providing DHCP to all devices, then all devices should appear in the modem DHCP tables.&nbsp; Orbi's in AP mode perform no router functions.&nbsp; They do not assign IP addresses.&nbsp; They do not NAT.&nbsp; They have no firewall.&nbsp; etc. etc. etc.&nbsp; So, if the modem DHCP tables do not contain your other devices, where did they get their IP's?
&nbsp;
Since my Orbi is not in AP mode, I cannot state for certain, however, my first attempt at capturing traffic would be to activate "Mirror WAN traffic to LAN port 1" on the Orbi debug page:&nbsp; (IP of Orbi Router)/debug.htm)&nbsp; Attach your Wireshark capture to port 1.

CrimpOn · Answer

I neglected to mention that besides mirroring WAN traffic to Port 1, Orbi's "debug screen" also allows capturing LAN/WAN traffic either to system memory or to a USB drive.&nbsp; I have done this numerous times, although I do not leave it running for a long time.&nbsp; To be honest, I have never tried saving to USB drive.&nbsp; If I wanted to capture a substantial amount of data, I would probably try that first.&nbsp; These capture files are zip files (compressed) and include LAN and WAN in separate Wireshark files, plus a bunch of other stuff.

Joined · Answer

Hello
&nbsp;
Thanks for the&nbsp; helpful advice FURRYe38,@CrimpOn and ekhalil.&nbsp; The VDSL modem is&nbsp; a Huawei HG659b. You were correct. I can see the individual IP devices in the IP table&nbsp; for the VDSL modem. I had read commentary here that NAT was enabled on the AP mode and had taken that as correct and not looked closely enough at the IP address listings of the Huawei. On your advice I have&nbsp; since attempted to test out the functionality of the WAN to LAN Port1 mirroring by clicking the setting under "ipaddress/debug.htm". I also tried the capture file setting to RAM since this hardware version does not support a USB socket. The capture file appeared all fine (I confess I got lost looking at the data not being a network specialist) . It did not seem to show individual IP addresses.&nbsp; I have also set up a windows tablet running Wireshark (and incidently&nbsp; Microsoft&nbsp; Message Analyser) connected (and monitoring ) Port1 of the LAN ports of the Orbi. (Now this was a challenge also: I am guessing that Port1 is the port that is closest to the external Internet port of the Orbi&nbsp; - am I correct here?).
&nbsp;
Both tools seem to capture all traffic except WiFi Apple devices such as my iphone or Ipad. Have I missed something obvious? is there a layer 2 or layer 3 issue here. Am I looking at the wrong layer?
As an another test I have also placed a DD-WRT based switch between the VDSL modem and the Orbi to show what the LAN DD-WRT&nbsp; status&nbsp; looks like. This display was equally uninformative.Showning very little activity. Presumably I will need to enable TCPdump but i just thought it was going to be a simple solution to capture the individual device traffic...Appreciate some indulgence if you have some time to comment further. Chris
&nbsp;

CrimpOn · Answer

My Orbi is in router mode, as I sense a large number of community members have theirs.&nbsp; The debug file contains logs of "WAN" traffic and of "LAN" traffic.&nbsp; Since my Orbi is indeed doing NAT on everything leaving the Orbi, the WAN Wireshark file does not identify any packets by their private address space.&nbsp; The LAN file does do so.&nbsp; My guess is for Orbi's in AP mode, the WAN file will show the private IP's assigned by the Huawei and the public IP's that they are communicating with.
&nbsp;
MY Orbi's LAN capture also has packets internal to the private IP space the Orbi has created.&nbsp; ARP requests, DHCP's, tons of broadcast packets, etc.&nbsp; I have no idea how the WAN and LAN captures differ for Orbi's in AP mode.
&nbsp;
Just a wild hunch, but I am not confident that capturing packets is going to provide the data you want.&nbsp; I am not a pro with Wireshark or other packet analysis software, but my impression is that you might be able to "count packets", but may not be able to count "bandwidth."&nbsp; Millions of pings, for example, do not consume as much bandwidth as streaming a single video.
&nbsp;
Sorry not to be more help.&nbsp;

FURRYe38 · Answer

What FW is currently loaded?What is the Mfr and model# of the ISP modem the NG router is connected too?
&nbsp;
Have you enabled Traffic Metter? This only collects overall usage for the entire system. I don't believe Orbi separates it down by devices.&nbsp;

Forum Discussion

RBR40 and RBS40 wifi - Wishing to capture/monitor traffic/BW usage of connected wifi devices

7 Replies