Hi OpenWrt Developers,
I want to monitor the traffic that connected clients on openwrt enabled routers are utilising, such as HTTP, SIP, RTP, and so on, every fifteen minutes.
Could you kindly advise me as to whether there are any built-in commands available to track this information or if any packages need to be activated as I am not receiving any direct commands in OpenWRT to get this information?
I tried using conntrack -L after configuring and verifying the IP tables rules, but it doesn't appear to function well for me.
Create iptables chains for marking SIP ,HTTP and RTP traffic
iptables -t mangle -N MARK_SIP
iptables -t mangle -N MARK_RTP
iptables -t mangle -N MARK_HTTP
Mark packets going to destination port 80 with mark value 1
iptables -t mangle -A MARK_HTTP -p tcp --dport 80 -j MARK --set-mark 1
Mark packets going to SIP (port 5060) with mark value 2
iptables -t mangle -A MARK_SIP -p udp --dport 5060 -j MARK --set-mark 2
Mark packets going to RTP (e.g., ports 5004-5100) with mark value 3
iptables -t mangle -A MARK_RTP -p udp --dport 5004:5100 -j MARK --set-mark 3
Apply the MARK_SIP and MARK_RTP chains to the FORWARD chain in the br-lan interface
iptables -t mangle -A FORWARD -i br-lan -j MARK_SIP
iptables -t mangle -A FORWARD -i br-lan -j MARK_RTP
iptables -t mangle -A FORWARD -i br-lan -j MARK_HTTP
conntrack -L --mark 2
conntrack -L --mark 3
conntrack -L --mark 1
Issue: I do not run any traffic which uses SIP but still conntrack listed the icmp traffic as SIP traffic with IP tables
root@RZYHGDJ00000079:~# conntrack -L --mark 2
icmp 1 29 src=192.168.31.1 dst=192.168.31.95 type=8 code=0 id=20336 packets=9 bytes=756 src=192.168.31.95 dst=192.168.31.1 type=0 code=0 id=20336 packets=18 bytes=1512 mark=2 use=1
tcp 6 7440 ESTABLISHED src=192.168.31.66 dst=192.168.31.1 sport=56188 dport=22 packets=137 bytes=13236 src=192.168.31.1 dst=192.168.31.66 sport=22 dport=56188 packets=80 bytes=16198 [ASSURED] mark=2 use=1
icmp 1 17 src=192.168.31.1 dst=192.168.31.66 type=8 code=0 id=18884 packets=34 bytes=2856 src=192.168.31.66 dst=192.168.31.1 type=0 code=0 id=18884 packets=68 bytes=5712 mark=2 use=1
tcp 6 7439 ESTABLISHED src=192.168.31.66 dst=192.168.31.1 sport=56197 dport=22 packets=229 bytes=17084 src=192.168.31.1 dst=192.168.31.66 sport=22 dport=56197 packets=94 bytes=13238 [ASSURED] mark=2 use=1
conntrack v1.4.6 (conntrack-tools): 4 flow entries have been shown.