RBR40 and RBS40 wifi - Wishing to capture/monitor traffic/BW usage of connected wifi devices

[Joined]

Hello 

Have had this model RBR40 RBS40 of Orbi for some time and am very  happy with its performance once I installed two corresponding satellite units. I am keen to capture the usage of each  wifi device connected to the Orbi base unit and the satellites. The Orbi base unit is set up as an AP. Ahead of the Orbi is a VDSL modem connected to the Internet. The VDSL modem provides the DHCP server for all  wired and wireless (wifi) connected devices on the LAN.  I note from looking at the ip table in the VDSL modem that all three  Orbi’s are assigned an individual IP address as expected. When I log into the individual  Orbi’s I can see the individual connected devices IP address but when I log into the VDSL modem I can only see the respective Orbi Ip addresses not the connected devices. My plan was to insert a monitoring  device to enable wireshark to capture all traffic. But I am guessing the Orbi NAT’s will not allow me to capture the wifi devices individually and since being a consumer product there will not be the option to disable the NAT.

i appreciate advice on what alternatives/ possible options I have to capture the individual wifi devices consumption “behind” the Orbi’s. I presume reconfiguring the network to change the role of the Orbi to a router rather than an an AP won’t help because the NAT remains. Any help appreciated since I wish to avoid replacing the Orbi’s. Chris

[FURRYe38]

What FW is currently loaded?
What is the Mfr and model# of the ISP modem the NG router is connected too?

Have you enabled Traffic Metter? This only collects overall usage for the entire system. I don't believe Orbi separates it down by devices. 

[CrimpOn]

Furrye38 asked the right question: what is the make and model of the modem you are connected to?

Something in your analysis may not be correct.  If the Orbi is in AP mode and the modem is providing DHCP to all devices, then all devices should appear in the modem DHCP tables.  Orbi's in AP mode perform no router functions.  They do not assign IP addresses.  They do not NAT.  They have no firewall.  etc. etc. etc.  So, if the modem DHCP tables do not contain your other devices, where did they get their IP's?

Since my Orbi is not in AP mode, I cannot state for certain, however, my first attempt at capturing traffic would be to activate "Mirror WAN traffic to LAN port 1" on the Orbi debug page:  (IP of Orbi Router)/debug.htm)  Attach your Wireshark capture to port 1.

[ekhalil]

---

@Joined wrote:

........... But I am guessing the Orbi NAT’s will not allow me to capture the wifi devices individually and since being a consumer product there will not be the option to disable the NAT.

............

---

Completely agree with @CrimpOn. Orbi in AP mode does not do any NAT. Only when you set Orbi in Router Mode it will do NAT.

[CrimpOn]

I neglected to mention that besides mirroring WAN traffic to Port 1, Orbi's "debug screen" also allows capturing LAN/WAN traffic either to system memory or to a USB drive.  I have done this numerous times, although I do not leave it running for a long time.  To be honest, I have never tried saving to USB drive.  If I wanted to capture a substantial amount of data, I would probably try that first.  These capture files are zip files (compressed) and include LAN and WAN in separate Wireshark files, plus a bunch of other stuff.

[CrimpOn]

Oh, fudge.  Also neglected to verify that RBR40 actually has a USB port.  Looks like it does not.  My bad.  Sorry.

[Joined]

Hello

Thanks for the  helpful advice @FURRYe38,@CrimpOn and @ekhalil.  The VDSL modem is  a Huawei HG659b. You were correct. I can see the individual IP devices in the IP table  for the VDSL modem. I had read commentary here that NAT was enabled on the AP mode and had taken that as correct and not looked closely enough at the IP address listings of the Huawei. On your advice I have  since attempted to test out the functionality of the WAN to LAN Port1 mirroring by clicking the setting under "ipaddress/debug.htm". I also tried the capture file setting to RAM since this hardware version does not support a USB socket. The capture file appeared all fine (I confess I got lost looking at the data not being a network specialist) . It did not seem to show individual IP addresses.  I have also set up a windows tablet running Wireshark (and incidently  Microsoft  Message Analyser) connected (and monitoring ) Port1 of the LAN ports of the Orbi. (Now this was a challenge also: I am guessing that Port1 is the port that is closest to the external Internet port of the Orbi  - am I correct here?).

Both tools seem to capture all traffic except WiFi Apple devices such as my iphone or Ipad. Have I missed something obvious? is there a layer 2 or layer 3 issue here. Am I looking at the wrong layer?

As an another test I have also placed a DD-WRT based switch between the VDSL modem and the Orbi to show what the LAN DD-WRT  status  looks like. This display was equally uninformative.Showning very little activity. Presumably I will need to enable TCPdump but i just thought it was going to be a simple solution to capture the individual device traffic...Appreciate some indulgence if you have some time to comment further. Chris

[CrimpOn]

My Orbi is in router mode, as I sense a large number of community members have theirs.  The debug file contains logs of "WAN" traffic and of "LAN" traffic.  Since my Orbi is indeed doing NAT on everything leaving the Orbi, the WAN Wireshark file does not identify any packets by their private address space.  The LAN file does do so.  My guess is for Orbi's in AP mode, the WAN file will show the private IP's assigned by the Huawei and the public IP's that they are communicating with.

MY Orbi's LAN capture also has packets internal to the private IP space the Orbi has created.  ARP requests, DHCP's, tons of broadcast packets, etc.  I have no idea how the WAN and LAN captures differ for Orbi's in AP mode.

Just a wild hunch, but I am not confident that capturing packets is going to provide the data you want.  I am not a pro with Wireshark or other packet analysis software, but my impression is that you might be able to "count packets", but may not be able to count "bandwidth."  Millions of pings, for example, do not consume as much bandwidth as streaming a single video.

Sorry not to be more help.