Is there a way to tell which computer is hogging up the wireless bandwith?

Question

I have a wireless router in my house and it's shared by five different computers and 2 iPhones. Lately I've noticed the speed drastically shoot down. Naturally, I though someone else was in the network but after checking the DHCP assigned addresses, I only see my machines. Valid machines.

Therefor I must conclude someone in my house is breaking the honor code and downloading things at all times of the day.

Is there a way for me to see which computer is consuming the most bandwith?

I have a wireless Linksys WRT54G router.

Answer 1

DD-WRT firmware for WRT54G can send traffic info to a MySQL database.

http://www.dd-wrt.com/wiki/index.php/Using_RFlow_Collector_and_MySQL_To_Gather_Traffic_Information

Make sure your version of WRT54G is supported before installing it.

http://www.dd-wrt.com/wiki/index.php/Supported_Devices#Cisco

Answer 2

Beware that with wireless you can't tell who the hog is just by looking at amount of data transferred. You have to look at the signaling rates used as well.

Here's an illustrative example:

Imagine you sample for 60 seconds and see that in that time, one client transferred almost 7 gigabits, and another client transferred just 45 megabits. Who's the hog?

Well, if the 7 gigabit guy was a modern 3 spacial stream 802.11n client getting the top-end 450 megabit per second signaling rate, he used up just one quarter of the airtime in that 60-second sample.

If the other guy was far from the AP, getting only the lowest 1 megabit per second signaling rate, he may have taken 45 seconds of airtime transfer his puny 45 megabits.

Without looking at signaling rates, it's easy to look at the 7 gigabit guy and think he's the hog, when actually he only used 1/4 of the time, whereas the little 45 megabit guy used 3/4 of the time.

This is an extreme example and I've oversimplified it by leaving out protocol overhead and retransmissions, but the point stands. Whatever solution you choose, make sure it accounts for airtime used, not just data transferred.

Answer 3

Some wireless network cards can be put into "monitor mode" which allows you to see all that's being transferred on a given channel. I only know how to do this on Linux:

• Stop using your wireless network card, i.e. tell any network configuration software to deconfigure it, and make sure it's not up (ifconfig). If you're using NetworkManager, you may have to stop it entirely to prevent it from interfering with this experiment.

Put the card into monitor mode. If this fails, it's probably because the card or driver doesn't support it.

iwconfig wlan0 mode Monitor

Set the right channel (one used by your network):

iwconfig wlan0 channel <number>

Set the card up.

ifconfig wlan0 up

Start Wireshark and capture wlan0. Note that this capture will be different than normal captures, because you will see the raw wireless frames rather than just the Ethernet payload. You also won't be able to see the payload if it's encrypted. You will however be able to see the MAC addresses in the IEEE 802.11 headers. Be aware that the access point forwards frames from one client to another, so it is expected to find a lot of traffic to and from the access point. You can identify the access point by its MAC address, which is printed on the access point enclosure. All you need to do then is find the client that's sending or receiving the most data. You can use display filters to help you, for example to filter out traffic not from your network.