Raspberry Pi as a network monitoring device

Question

I was thinking it would be cool to have my Raspberry Pi (RPi) monitor how long a computer/mobile device is connected to the network. This would be useful to figure out how many hours I spend on the internet, when at home (do I really want to know? :P).

I was thinking the RPi could some how talk to router and make a log of when a device of a particular MAC address is connected.

Could anybody point me in the right direction?

Answer 1

This is quite tricky to answer without having more details. What @bortzmeyer wrote could have also some difficulties.

Ping - this could be wrong solution when your device has DHCP assigned address. In this case address could change (this depends on router configuration and lease files but is possible to happened). If you have static IP configuration this will work fine always.

SNMP - this depends if your router has SNMP server and could answer SMMP queries.

You can wrote some monitoring application and place it on your Pi. This could use ARP (RARP) to check if given MAC address is connected to the network (assuming that your Pi is in the same network as the rest of the devices).

Other way could be figure out if your router could export somehow log file (or better automatically log to remote host). In this case you can parse logs and figure out who and when is connecting to your network.

Last solution (will work always but is most obscure) is to parse web interface output. All home routers has web GUI for configuration. You can parse its output periodically to figure out if client is connected or not.

Answer 2

I am tracking network traffic of my TPLink router using a Raspberry Pi that is running collecd.

Install collectd with sudo apt-get install collectd collectd-utils

Edit /etc/collectd/collectd.conf to enable the SNMP plugin (uncomment) and to configure. Here's an example of my setup:

<Plugin snmp>
  <Data "if_Octets">
    Type "if_octets"
    Table true
    Values "IF-MIB::ifInOctets" "IF-MIB::ifOutOctets"
  </Data>
  <Host "tp-link">
    Address "192.168.0.1"
    Version 1
    Community "public"
    Collect "if_Octets"
    Interval 60
  </Host>
</Plugin>

I set it up to send metrics to www.librato.com as it was the quick and simple (no installation of metric data store or visualization required).

Answer 3

I haven't tried the following solution, but if you have a compatible Linksys router (or maybe other manufacturers), you can enable the logging feature (as codewarrior already suggested. Thanks to him). Then, you need to specify the IP address where you want the logs to be stored (your RPi's).

On your RPi, install one of the implementation of syslog. syslog-ng or rsyslog for instance:

sudo apt-get install syslog-ng-core

Then, configure /etc/syslog-ng/syslog-ng.conf, and add the following lines:

source s_myrouter {
    udp(ip(0.0.0.0) port(514));
};

filter f_myrouter { host("192.168.1.1"); }; # replace with your router's IP address

destination d_myrouter { file("/var/log/myrouter.log"); }; # replace with where you want to log

log { source(s_myrouter); filter(f_myrouter); destination(d_myrouter); };

You will probably have to adapt f_filter to your needs to avoid to /var/log/myrouter.log to take hundreds of megabytes.

Then, you will need to parse /var/log/myrouter.log with a script to extract the information you want.

Answer 4

use Nagios. it is specific for moitoring IP devices and is available as a simple install via "apt-get install nagios3:

like wise it takes a bit getting ones head around the method of setup but each device is a txt file containing the device/network information. I had it running on my home Raspberry and works just great. Should be ok for a few hundred IP devices. It also has SNMP modules that can query/status report and even control devices.

also has web server via whatever is on your Pi and this can be set accessable from anywhere in the ip universe. just make the Pi as a DMZ or forforward the web server port.

Search for Nagios 3 in the Raspberry Pi device.

Good luck.

Answer 5

I suggest CloudView NMS http://www.cloudviewnms.com Their website has detailed instructions for Raspberry Pi It is universal network monitoring system which can monitor network devices (switches, routers...) servers via standard protocols including SNMP with rich GUI for multiple standard MIBs.

Answer 6

I see two approaches: the simplest one seems to be to ping, from the Pi, your machine (assuming it allows ICMP echo requests). If you insist on the second one, using the router, it seems more complicated but you can send SNMP queries from the Pi, with a tool like snmpget (package net-snmp) and asks for the ARP table ipNetToMediaTable.

BTW, I write an article (in French) about using the Pi for monitoring (but not exactly what you want) : http://www.bortzmeyer.org/icinga.html

Answer 7

I understand the fun behind wanting to do this yourself as a fun little project, but if you're just looking after a solution to your request I would recommend you use software on your computers themselves. I use TimeSink for Mac, but I'm sure there are alternatives for other operating systems.

Answer 8

Check this out:

http://code.google.com/p/epoller/

It's a snmp data collector that runs well on the raspberry pi.