Building an Ethernet bandwidth monitor - Suggestio

Yes this can be done. I recommend that you use the Arduino Ethernet Sheild (wiznet chip) or the adafruit one with the wiznet chip. Go to the wiznet web site and look at their sample code. They have samples that will let you get to layer 2 and bypass layer 3. I have a large project that will be doing extensive use of layer 2 (i.e. implementing a protocol that is not TCP or UDP). I have looked at the sample code enough to know that it can be done. What I am going to build will have what you are looking to do as one of the many options.

Let me know how you make out and we can help each other.

If you cant find the sample code on the wiznet site, let me know and I will go find the link again.

Mark

You may also be able to monitor packet traffic using analog electronics without any ethernet controller at all. Each packet is a burst of AC "noise" on some set of signal wires, so the total amount of traffic is (to some approximation) a measure of how much/often noise is happening on those wires...

Even cheap routers provide a switch, not a hub, so unless you have the ability to force the switch to mirror traffic you will only see packets addressed to your node and broadcasts; you will not see traffic addressed to other nodes.

-j

I'd find this a very useful device to connect between my ethernet gateway and the wall outlet - it could easily show (through LED-bargraph or LCD) when the connection is heavily loaded, and perhaps act as a warning device if the activity is suspiciously high for some reason.

Westfw,
Interesting you mentioned this. Going analog was my original plan but then I got a digital oscilloscope connected to an Ethernet line and I couldn't really tell the amount of traffic just by looking at the wave.
I learned that 100Mbps uses a three-levels encoding -1, 0, +1 and even with no traffic the signal would still constantly change within those three values to provide clock synchronization.
http://www.erg.abdn.ac.uk/users/gorry/course/phy-pages/4b5b.html

kg4wsv,
I was simply planning to "tap" on the Tx and Rx wires that run between the broadband router and the cable modem. kind of like you would do by connecting an oscilloscope to the line.

Just don't forget how UTP works - when one wire in each twisted pair is high, the other is low - so the same amount of current is always passing through the line. This method allows countering for noise on the line by simply examining the difference in voltage level between the paired wires.

You could theoretically tap the Tx and Rx pairs and monitor them both for wave changes, simply counting the wave changes would give a good idea of the very lowest fundamental level of traffic on the network.

Mark S,
That's some good information you provided. Basically I would have to use the wiznet adapter at a MAC level (layer 2) and count the bits.
Do you know if bps data is readily available off the chip or I would have actually count the bits?
Looks like I would have to use either one of those WIZ811 or WIZ810 but I am a little afraid at the fact that these devices use SPI. How do you interface SPI with the Arduino?
Also you mentioned some sample code on their website. I looked everywhere (FAQ, Support, Q&A, forum) but I couldn't find anything. Do you happen to have a copy you can send to me?

Thanks

I think that tapping into the RX / TX cables can easyli introduce noise that can have a very bad influence on the quality of the line.

There are some fairly strict rules about loading, capacitance, etc in UTP ethernet lines. It would be easy to get those out of spec so that you cause yourself some network problems. If you take this approach, make sure you monitor the error count (on both sides of the connection if possible) to see if your device causes problems.

Maybe another approach would be to use the ethernet-arduino combination to pull data from the router and monitor traffic that way. It does assume a correctly functioning router, but that's not a terribly unreasonable assumption.

Maybe your router can run dd-wrt, enable SNMP, and write some Arduino software to poll the router with SNMP. That would be a system with a lot of other potential uses.

good luck!

-j

You might also look into chips that implement only the PHY functions of the ethernet (most modern controllers integrate phy and mac in the same chip.) That would give certainly give you analog info on packets.

In the other direction, many of the higher-end ethernet chips include extensive on-chip statistics, so you could probably read "missed packet" counts off them without ever having to actually receive any packets.

I have a large project that will be doing extensive use of layer 2 (i.e. implementing a protocol that is not TCP or UDP).

Sounds interesting, are you at liberty to tell us more about your project? I suspect there's a lot of untapped power in the use of the Wiznet's lower-level functionality.

Looks like I would have to use either one of those WIZ811 or WIZ810 but I am a little afraid at the fact that these devices use SPI. How do you interface SPI with the Arduino?

This is not an issue. These modules use the same chip (W5100) as the official Arduino Ethernet shield so if it's wired up the same way (the SPI pins are a specific set of pins on the Arduino--only the chip select line can differ, I don't know if it's used for the shield) you can use some or all of the standard Ethernet library. The lower level functionality isn't specifically exposed though.

If you want a quick and easy way of getting started the shield is probably the best way to start. Otherwise you might want to start reading my Learning about Arduino and WIZ810MJ notes.

--Phil.

all of the devices you have connected to your network have LEDs indicating the traffic on the line they are connected to so just connect your Arduino to the LED and look at the duty cycle. There's your traffic and you might even have a collision detection LED which could show even more data once your traffic gets even slightly loaded.

Doug

Follower,
I found your page in the past when I was looking for information on the WIZ810 but I noticed many links are broken.
In particular you have one titled "W5100 and MACRAW" which sounds interesting but is broken. (looks like wiznet redesigned their website, that's why).
Westfw made an interesting comment using some PHY chip. I've never used those before but it may be the right way to go if I just want raw throughput information. I believe pure PHY chips don't even handle MAC addresses, they simply take the electrical signal from the twisted pair and convert that to a stream of bits.
Can someone confirm this?
Also, can anyone suggest one of those PHY chip to be used for this project? It would have to be the simplest/cheapest available.

thx

The Microchip ENC28J60 is a layer 2 device. The IC is probably cheaper than the Wiznet IC. nuelectronics sells an ethernet shield based on that device; not sure how the price compares to the official ethernet module.

Dougl, clever idea about using status LEDs. The wiznet module (not the official ethernet shield!) has pins for those LEDs available.

-j

An inline tap between your modem and switch/router will expose all traffic in and out of the network. you need to make sure that the arduino is only passively monitoring the traffic otherwise your risk corrupting your packets.

Sounds like a rather useful device.
being able to see all incoming and out going bandwidth usage, maybe even be able to break it down to packet type reporting (x% TCP y% UPD z% Other)

noticed many links are broken.
In particular you have one titled "W5100 and MACRAW" which sounds interesting but is broken. (looks like wiznet redesigned their website, that's why).

Thanks for the feedback--it doesn't surprise me that some of the links are broken--I've added a Google search to that item which might help you find what you are looking for.

Hope that helps.

--Phil.

dbunting:

being able to see all incoming and out going bandwidth usage, maybe even be able to break it down to packet type reporting (x% TCP y% UPD z% Other)

this is exactly what I'm working on. I don't know if it is possible (processing power) but if I could just -depending on the type of packet- send different serial commands to the arduino that would already be a great step forward. also srcport, destport and possibly other values can be interesting information.

Luca: by going analog you would lose a great deal of potentially interesting information don't you think? also noise could give you lots of false alarms.

I'm gonna try some thing with all the info earlier in this post. I have the wiz5100 ethernet-shield btw

mmm////as for me I use protemac meter...

Hi you can try to use ProteMac Meter too.It[ch8217]s tool record of your network and display internet traffic.It[ch8217]s must be helpful to your.It[ch8217]s really good tool. :smiley: