Using the Tomato Firmware to Monitor Bandwidth by IP Address

June 27, 2012

While the process of installing different open source routing firmware on my Asus RT-N16 router has been an extremely useful learning experience, much of it I’ll probably forget in a few months as I need very little, if any, of the extra configuration parameters offered. The latest version of the Asus firmware was very stable, and offered the needed functionality for routine home networking tasks.

However, there was one feature I was interested in, but not sure I would find. This feature was to be able to monitor the bandwidth usage by the individual devices attached to our home network. Typically this is referred to as monitoring bandwidth by IP address. In particular, I wanted to be able to see which computer was using the most of our Internet connection.

We had recently switched Internet Service Providers from AT&T Uverse to Comcast XFinity. The main reason was the reliability of the Uverse equipment, but the secondary and equally important reason was the monthly cost.

As it has turned out over the past few months, returning back to Comcast this time around has been a pleasant experience. Local competition from AT&T in our local market, I believe, has resulted in Comcast customer support being pleasant to work with now. Our Internet connection speed has been at least several times faster without having to purchase one of their high end options. We do miss some things from AT&T Uverse however, including the whole house DVR and a few cable channels they have which Comcast does not.

A Broadband Bandwidth Hogging Problem

The problem I started noticing after the first couple of months of Comcast service was obvious by viewing the Internet Broadband usage graphic in our online account. We were easily using up the bandwidth limit for our account each month. Comcast had in no way limited our Internet service, or charged us extra for the excessive broadband usage, but I figured they could.

I really had no idea what was using the large amounts of broadband. I had configured online backups, but was careful to make sure only changes were uploaded each night. I just didn’t see how this could be the culprit. We were not downloading movies, although we plan to. The only other possibility was our teenage son, but I didn’t think Internet games or Xbox games were that much of a bandwidth hog.

An Internet Broadband Monitoring Solution

The Asus firmware, DD-WRT and TomatoUSB open source firmware all offered bandwidth monitoring functionality. But none of them offered the ability to monitor it by IP address within our home. I did discover that there is a special version of the TomatoUSB firmware which does have the capability to monitor by IP address. It’s called the “Toastman” build. His site, with the background for this build and a lot of other useful information, can be found at: Toastman’s Tomato….

The forum for the Toastman Tomasto build can be found at: Tomato Firmware Forum on LinksysInfo.org. The specific build I loaded on my Asus RT-N16 router was the “tomato-K26USB-1.28.7499.1MIPSR2Toastman-VLAN-RT-Ext.trx” on Toastman Builds.

Installation of the Toastman Tomato Firmware

I did some investigation of the Toastman firmware builds and determined that the ones with the VLAN in the name had the IP Bandwidth monitoring option. The rest I learned earlier from installing the TomatoUSB build: I needed the “K26” for the Asus RT-N16 hardware along with the “MIPSR2” feature; the “USB” was needed for… USB support and the “Ext” portion of the name represented the extra functions provided by the firmware, which I already had.

I did not find (or look for) specific instructions on installing the Toastman build. I figured that since I already had the TomatoUSB firmware installed, I could simply use the Admin function for installing firmware upgrades. I didn’t think this would be that much of a risk.

Make sure you enable/check the option to “After flashing, erase all data in NVRAM memory”. It is disabled by default.

The upgrade process went so smoothly that once the router rebooted I initially thought that the upgrade did not work. The screens all looked the same. I then went to the “About” screen and the additional Toastman credits were displayed. I also began to see menu options for IP Traffic. This is what I was looking for.

Once I knew that the upgrade was successful, I changed the color scheme to “Asustek”. I like this better than the “Tomato Red” scheme.

One other difference with the Toastman firmware builds is that the DHCP Server is disabled by default. I did this using the Basic / Network screen. There should be one entry under the LAN options for Bridge STP. Click this row to open up the maintenance view and check the DHCP option to enable it. Click the OK button when finished. I also clicked the “Save” button at the bottom of the screen.

The Broadband Bandwidth Problem Solved

I came back to the router the next day, and by that time all of the IP addresses had been automatically renewed so that their hostnames were also available to view. If you don’t want to wait, just perform the IPCONFIG / RENEW command using a command prompt window and each of your network clients.

The first screen I reviewed was the IP Traffic Daily History. From this graphic it was easy enough to see that my teenage son was using up Internet bandwidth faster than 2 liters of Mountain Dew. In one day alone his PC used up over 9 GB of Broadband transfers.

A different way of looking at this was to use the “Last 24 Hours” view. For this view, you need to select just one of the IP addresses at a time. I was impressed that my Internet provider was capable of 4709 kbits/s transfer rate – UPLOAD. However, I was already quite certain that this was not how I wanted our monthly Internet bandwidth being used each month.

At this point, now that I had the offending network client, it was a matter of questions and answers and testing to determine the cause. The only online game he had been playing was League of Legends. A quick Google search revealed this game installed the “Pando Media Booster” application which did a lot of Internet uploads in the background. We found this on both of his computers and quickly, and easily, uninstalled it.

I waited another few hours to see if the problem was solved. During that time, it was seen that over 2 GB more data had been uploaded. Google was not any more helpful, so we resorted to Windows Task Manger. The process at the top of the list was uTorrent.

Now I’m not a Torrent expert, but I know enough to understand what it does. The fact that it was using only 1 or 2 percent of the CPU meant that something was being transferred. The program was easy enough to uninstall, as there was a program in Windows Control Panel / Programs and Features to uninstall called “uTorrent”. However, there was no way to know which program installation installed it, or what it was actually doing.

Once uTorrent was uninstalled, all of the IP Traffic graphs in the router firmware “Flat-lined”. The source of our Internet bandwidth hogging had been eliminated. It was not anything my son had knowingly installed or was using. I hope the League of Legends game did not install this, as we’re paying a monthly amount for this. I had assumed that “popular games with a cost” are generally safe to install and use – maybe not? Something to look into.

The next day I checked the chart below which shows the bandwidth activity on this PC over the last 24 hours. The massive Internet uploads has stopped and the activity looks more normal.

Final Router Firmware Conclusions

The Toastman build of the Tomato router firmware is the one that will be staying installed on our Asus RT-N16 router. Many of the additional configuration options provided by this firmware we don’t really need right now. I almost reinstalled the standard firmware from Asus. However, the built-in ability provided by the Toastman build to monitor bandwidth by IP address makes this firmware my favorite by far.