InfluxDB is a time series database. This means it is specialized in collecting, storing and querying sequences of measurements over a time interval. It is great doing this job, and since it’s exactly the job that we need, we’re going to use it.
As always the steps on this article are for Debian-based Linux distributions. Just issue these commands:
naikel@htpc ~ $ wget https://s3.amazonaws.com/influxdb/influxdb_0.10.1-1_amd64.deb naikel@htpc ~ $ sudo dpkg -i influxdb_0.10.1-1_amd64.deb naikel@htpc ~ $ sudo /etc/init.d/influxdb start Starting the process influxdb [ OK ] influxdb process was started [ OK ]
If you prefer to add a PPA to your repository list, follow these instructions instead.
If everything went fine then we can login through the console like this:
naikel@htpc ~ $ influx Visit https://enterprise.influxdata.com to register for updates, InfluxDB server management, and monitoring. Connected to http://localhost:8086 version 0.10.1 InfluxDB shell 0.10.1 >
Or we could log in through the GUI at http://localhost:8083
We need to configure the database for our network traffic data. Let’s just create a new database called traffic. You can do it through the console or through the Web GUI:
naikel@htpc ~ $ influx Visit https://enterprise.influxdata.com to register for updates, InfluxDB server management, and monitoring. Connected to http://localhost:8086 version 0.10.1 InfluxDB shell 0.10.1 > create database traffic
Now we need to populate the database with time based data.
First we need to create a script that will run in the DD-WRT enabled router that will let us gather statistics from every device in the same LAN the router is. The idea is that per every device in your LAN the script will create two entries in a new chain in the enabled router’s iptables, one for incoming packets, and another one for outgoing packets, both with target RETURN, so it returns to the original chain. Then in the FORWARD chain we are going to send to the RRDIPT chain every single packet there, the RRDIPT chain will count the packet, and then will return to the FORWARD chain.
The FORWARD chain will have an entry like this:
root@DD-WRT:/jffs/bin# iptables -L FORWARD -n Chain FORWARD (policy ACCEPT) target prot opt source destination RRDIPT 0 -- 0.0.0.0/0 0.0.0.0/0
And the RRDIPT chain will have an entry per every device like this:
root@DD-WRT:/jffs/bin# iptables -L RRDIPT -n Chain RRDIPT (1 references) target prot opt source destination RETURN 0 -- 192.168.100.107 0.0.0.0/0 RETURN 0 -- 0.0.0.0/0 192.168.100.107
This script has to run every minute in the router’s cron to gather statistics and every hour or so to detect new devices in your LAN. Also remember to change the DBURL environment variable with the URL of your InfluxDB database in your LAN.
To do this you have a couple of choices depending on if you can enable JFFS or not in your router.
JFFS Capable Router
If your router has enough memory then you can enable JFFS. Follow the instruction on how to enable JFFS in your DD-WRT enabled router first and copy the script in /jffs/bin and name it trafficmon (no extension). Remember to give the script execution permissions (chmod +x trafficmon).
Now you have to enable cron in the Administration tab of your router and paste the following lines in the Additional Cron Jobs field:
* * * * * root /jffs/bin/trafficmon update 0 * * * * root /jffs/bin/trafficmon setup
If you want to be more elegant, create instead a startup script in /jffs/etc/config to include the cron lines you need every time you restart your router:
root@DD-WRT:/jffs/etc/config# cat trafficmon.startup #!/bin/sh echo '* * * * * root /jffs/bin/trafficmon update' >/tmp/trafficmon echo '0 * * * * root /jffs/bin/trafficmon setup' >>/tmp/trafficmon mv /tmp/trafficmon /tmp/cron.d/trafficmon /jffs/bin/trafficmon setup
Don’ t forget to give execution permission to the startup script (chmod +x trafficmon.startup).
No JFFS Available
If your router has no enough memory and you don’t have or can’t create a JFFS partition, then you need a web server in your LAN to host the script. Enable cron in the Administration tab of your router and paste the following lines in the Additional Cron Jobs field. Remember to edit them to point to your web server since in the following example we’re assuming the script is hosted at http://192.168.100.100/trafficmon
* * * * * root if [ -f /tmp/root/trafficmon ]; then ( /tmp/root/trafficmon update ); else ( /usr/bin/wget -q http://192.168.100.100/trafficmon -O /tmp/root/trafficmon && chmod +x /tmp/root/trafficmon && /tmp/root/trafficmon setup ); fi 0 * * * * root /tmp/root/trafficmon setup
Checking Work So Far
If you have left your router doing its job for more than a minute then you should already have data in your InfluxDB. You can query the data using the InfluxDB’s Web Interface at port 8083 in your server (remember to choose the database first before querying the data):
Everything looks great! Now we just need to create graphs for this data.
Grafana is the software that generates graphics for several time series databases, including of course InfluxDB. Just issue the following commands to install it:
naikel@htpc ~ $ curl -O https://grafanarel.s3.amazonaws.com/builds/grafana_latest_amd64.deb naikel@htpc ~ $ sudo dpkg -i grafana_latest_amd64.deb naikel@htpc ~ $ sudo service grafana-server start * Starting Grafana Server [ OK ] naikel@htpc ~ $
If everything went well you can login at http://localhost:3000. The default login and password are admin.
Configure the Data Source
Let’s configure our InfluxDB as a data source in Grafana. Go to Data Sources and click on New. Fill the form with a name for your InfluxDB database (I used “InfluxDB”) and select InfluxDB as Type. If Grafana and InfluxDB are running in the same server, the URL should be http://localhost:8086. We named our InfluxDB database “traffic” and just type anything in the user and password fields. Those are not used but if they are empty Grafana won’t let you go on.
It should look like this:
Click on Add and we are ready to create some graphs.
Create Some Graphs
Create a new Dashboard clicking on Home and then New and then add a new graph clicking in the green icon at your left (that’s the menu of the row) and then on Add Panel and then Graph.
Select InfluxDB as your query type and then add two queries (one for the downstream and another one for the upstream of the host you want to create the graph for).
Now define the queries like this in the Metrics tab:
As you can see since we are collecting data every minute but we want to show bytes per second, we have to divide the average (the mean) by 60.
You can define some nifty legends and stuff in the Axis & Grid tab:
And the graph should look like this:
Do this for every device in your home or office and that’s it! If you want a graph with all the traffic select the MAC address 00:00:00:00:00:00.