DD-WRT :: View topic - YAMon 3.4 - usage monitoring for your router

YAMon 3.4 - usage monitoring for your router

DD-WRT Forum Index -> General Questions

Goto page Previous 1, 2, 3 ... 15, 16, 17 ... 44, 45, 46 Next

View previous topic :: View next topic

Author

Message

al_c
DD-WRT Guru

Joined: 13 Apr 2013
Posts: 2134
Location: Ottawa Canada

Posted: Sat Sep 15, 2018 15:13 Post subject:

BarkingSpider wrote:

Hey Al...Some problem just started on 09/10/2018. All has been fine...however starting on 09/10/2018, I have no data since. Here is a snip of the log.

hu({"mac":"un:kn:ow:n0:0m:ac","hour":"15","down":0,"up":1888})
hu({"mac":"e0:cb:1d:f5:6e:20","hour":"15","down":178,"up":181})
hu({"mac":"00:90:a9:e0:b2:03","hour":"15","down":1409,"up":991})
hu({"mac":"e0:46:9a:6a:e7:93","hour":"15","down":589,"up":651})
16:00:28 1 _thisHrpnd: (15)
pnd({"hour":"15","uptime":19542743.73,"down":1097805699195,"up":109902985627,"lost":1888,"hr-loads":"0.00,0.00,0.12,0.22"})
16:03:58 2 checkChainEntries: YAMON34v4 returned only 0 entries?!? Resetting iptables rules
16:04:00 2 >>> 14:91:82:32:6b:75 exists in users.js... updating ip to '192.168.1.1' / o_ip: 73.239.111.174
.
.
.
17:00:02 1 _thisHrpnd: (16)
pnd({"hour":"16","uptime":19546317.53,"down":1097815487765,"up":109906331192,"lost":0,"hr-loads":"0.00,0.02,0.16,0.35"})
17:04:02 2 checkChainEntries: YAMON34v4 returned only 0 entries?!? Resetting iptables rules
.
.
.
18:00:07 1 _thisHrpnd: (17)
pnd({"hour":"17","uptime":19549922.97,"down":1101301542882,"up":109939080218,"lost":0,"hr-loads":"0.00,0.02,0.58,0.58"})
18:04:08 2 checkChainEntries: YAMON34v4 returned only 0 entries?!? Resetting iptables rules
18:04:10 2 >>> 14:91:82:32:6b:75 exists in users.js... updating ip to '192.168.1.1' / o_ip: 73.239.111.174
18:04:13 1 clearDupIPs: ip: 192.168.1.1
18:04:13 1 >>> Device 14:91:82:32:6b:75 & 73.239.111.174 was updated to 14:91:82:32:6b:75 & 192.168.1.1
18:04:13 2 >>> 14:91:82:32:6b:75 exists in users.js... updating ip to '169.254.255.1' / o_ip: 192.168.1.1
18:04:15 1 clearDupIPs: ip: 169.254.255.1
18:04:15 1 >>> Device 14:91:82:32:6b:75 & 192.168.1.1 was updated to 14:91:82:32:6b:75 & 169.254.255.1
18:04:15 2 >>> 14:91:82:32:6b:75 exists in users.js... updating ip to '73.239.111.174' / o_ip: 169.254.255.1

Any ideas what has happened or how to fix?

Did you make any changes on your router recently? Update the firmware? Change any settings?

Have you tried the IT solution of last resort...rebooting your router?

I don't know why you are getting the `external` IP address changes?!? Can you set loglevel=0 in config.file and then send the log to questions@usage-monitoring.com?

Thanks! (and sorry)

Al

It seems

Sponsor

ColoradoUser
DD-WRT Novice

Joined: 12 May 2018
Posts: 31
Location: Broomfield, Colorado USA

Posted: Sat Sep 15, 2018 19:42 Post subject: Re: Live database anomalies

al_c wrote:

Thanks for pointing these out...

ColoradoUser wrote:

Thought I would mention a couple of anomalies … although it could just be me doing something bonehead. Anyway …

1) Even though I’ve followed the instructions to clear local storage, ‘re-sync’, and dismiss the message, I’m still seeing database issues. And the notification message shows up every time I open YAMon.

Nuts... is anyone else seeing this? I'm not.
After you re-sync, does a localStorage variable name `YAMon3-mesages` get created? It should!

Oops... I was only setting that LS variable if you clicked the `re-sync` link in the annoying message, not if you re-sync from the Active Connections table... I've changed that now.

ColoradoUser wrote:

2) Similar to other comments, I get an external lookup associated with 192.168.1.1 and 192.168.1.255. In my case the association is with Puntonet S.A. in Otavalo, EC. At times there are two or three dozen of these in my Live table when I have lots of network activity.

I'll look into that... I wasn't seeing it before because I had an entry for `192.168` in my `Local IPs` field (click the gear icon in the top right corner of the Active Connections table.

Hmmm... When I looked at my reports I saw Puntonet everywhere too. It appears that every so often my whois call returns a CIDR that covers a great swath of IP blocks. I'll have to look into that. In the mean time, I've deleted the offending entry.

ColoradoUser wrote:

3) Puntonet S.A. also gets associated with some other IPs which are actually in the US. I can pass a few of those on to you if needed. It’s almost like this association is a default if the IP isn’t otherwise located … but I can manually identify the IP with whois. This might occur with other non-US IP addresses, but I’ve only looked up a few and in my case they were all US.

please pass them along... but see note above

ColoradoUser wrote:

4) 99.193.234.125 (an IP for DirecTV in El Segundo, CA) gets a Canadian flag for some odd reason. This is the only flag mis-association I’ve noticed.

Again, there was a funky entry in the tables which I've removed. I've re-added an entry for 99.193.234.125 into the table.

I've also made some minor changes in the JS code to better re-sync things. Clearly this is still a work in progress... Smile

I did a clear and resync to test the changes.

Re 1) Fixed. Looks like you got it. Message has gone away.

Re 2) Fixed. 192.168.1.1 and 192.168.1.255 now show properly (not associated with external IPs).

Re 3) Fixed (probably). I’m not seeing Puntonet S.A. show up at all now, but given it is the weekend and the grandkids are all away to their homes my network is very quiet. I will keep an eye on this and let you know if I see anything odd after they come back and heat it up.

Re 4) 99.193.234.125 now has a US flag. But given the fix for Puntonet and the fact that my network is quieter I was able to see another one: 72.14.188.52 Rogers Cable Stittsville, CA shows up with a Canadian flag. But I don’t see any others right now. These are just little anomalies but the flags sure make it easier to see if the kids are connecting with places maybe they shouldn’t (not that Canada is a problem!). I will keep an eye on this as well and let you know in case it helps you find a pattern.

Can’t thank you enough for YAMon. This tool is a big help – and fun to tinker with when I’m not really looking for anything.
Mike

al_c
DD-WRT Guru

Joined: 13 Apr 2013
Posts: 2134
Location: Ottawa Canada

Posted: Sat Sep 15, 2018 21:06 Post subject: Re: Live database anomalies

ColoradoUser wrote:

[
<<Snip>>

I did a clear and resync to test the changes.

Re 1) Fixed. Looks like you got it. Message has gone away.

Re 2) Fixed. 192.168.1.1 and 192.168.1.255 now show properly (not associated with external IPs).

Re 3) Fixed (probably). I’m not seeing Puntonet S.A. show up at all now, but given it is the weekend and the grandkids are all away to their homes my network is very quiet. I will keep an eye on this and let you know if I see anything odd after they come back and heat it up.

Re 4) 99.193.234.125 now has a US flag. But given the fix for Puntonet and the fact that my network is quieter I was able to see another one: 72.14.188.52 Rogers Cable Stittsville, CA shows up with a Canadian flag. But I don’t see any others right now. These are just little anomalies but the flags sure make it easier to see if the kids are connecting with places maybe they shouldn’t (not that Canada is a problem!). I will keep an eye on this as well and let you know in case it helps you find a pattern.

Can’t thank you enough for YAMon. This tool is a big help – and fun to tinker with when I’m not really looking for anything.
Mike

Again thanks for the feedback

RE#4... if you ask certain folks, Canada *is* a security risk to youse guys... LOL

Stittsville is my stomping grounds and it is most definitely in Canada. 72.14.188.52, however should be located in Dallas TX...

Hmmm... after deleting the entries, the results I get from a lookup of my ISPs IP (Rogers) returns a too-wide CIDR that blots out other smaller IP block. I'll look at that ASAP (I'm afraid I might have to redo the IP lookup functionality again!)

Al

ColoradoUser
DD-WRT Novice

Joined: 12 May 2018
Posts: 31
Location: Broomfield, Colorado USA

Posted: Sat Sep 15, 2018 21:32 Post subject: Re: Live database anomalies

al_c wrote:

Stittsville is my stomping grounds and it is most definitely in Canada. 72.14.188.52, however should be located in Dallas TX...

Well color me (maple leaf) red. I saw "CA" and automatically thought California. Duh (with US generic accent).

BarkingSpider
DD-WRT User

Joined: 29 Jan 2014
Posts: 98

Posted: Sun Sep 16, 2018 5:57 Post subject:

al_c wrote:

BarkingSpider wrote:

There have been no changes or anything that I know of. I did re-start YAMon and it has started collecting data again. The messages of:
CheckChainEntries: YAMON34v4 returned only 0 entries?!? Resetting iptables rules
is now gone but replaced by:
2 !!! No matching entry in _currentUsers for 00:0c:29:82:0a:bd / 192.168.1.1 (192\.168\.1\.1)?!? - adding 32 to unknown mac
The odd thing is that mac address belongs to one of my VM machines (which is currently not active). The users.js file says this:
ud_a({"mac":"00:0c:29:82:0a:bd","ip":"192.168.1.126","ip6":"","owner":"VM","name":"AE668463","colour":"","added":"2018-08-29 15:47:29","updated":"2018-08-29 15:47:29","last-seen":"2018-08-29 15:47:29"})

I won't have time over the next few days, but I'll try to get more logging.
_________________
Netgear R7800: DD-WRT v3.0-r47822 std (12/09/21)
Linksys wrt1900acsV2: DD-WRT v3.0-r47822 std (12/09/21)

al_c
DD-WRT Guru

Joined: 13 Apr 2013
Posts: 2134
Location: Ottawa Canada

Posted: Sun Sep 16, 2018 19:10 Post subject:

BarkingSpider wrote:

al_c wrote:

BarkingSpider wrote:

Can you send me your users.js... it could be a regex is too liberal and is matching multiple entries...

Please zip and send the file to questions@usage-monitoring.com

thx

BarkingSpider
DD-WRT User

Joined: 29 Jan 2014
Posts: 98

Posted: Mon Sep 17, 2018 19:55 Post subject:

al_c wrote:

BarkingSpider wrote:

al_c wrote:

BarkingSpider wrote:

Can you send me your users.js... it could be a regex is too liberal and is matching multiple entries...

Please zip and send the file to questions@usage-monitoring.com

thx

users.js file has been sent.
_________________
Netgear R7800: DD-WRT v3.0-r47822 std (12/09/21)
Linksys wrt1900acsV2: DD-WRT v3.0-r47822 std (12/09/21)

whitebeard
DD-WRT User

Joined: 26 Jul 2013
Posts: 121
Location: Canada

Posted: Tue Sep 18, 2018 23:06 Post subject: Usage of Custom.css

Hi Al,

Using the latest (3.4.5) on an Asus RT-N66U and all is working well. Just wanted to remove the Hourly Report and went into the CSS to edit:

Code:

#hourly-table-div {
display: none; // used to be flex
}

And this worked well on the main CSS (believe it's called YAMon3.4.css). I added this to the Custom.css and it is there but I guess I thought it was supposed to override the main CSS. Is there a way of doing this?

Thanks.

EDIT: In trying to locally fix the issue I tried to bring in the files using _doLocalFiles='1' in config.file which somehow didn't work as YAMon would startup complaining of a missing JS file. I ran the procedure manually with doLocalCopies.sh and is it possible the variable "_setupWebDir" should be "_webDir"?

Last edited by whitebeard on Thu Sep 20, 2018 15:11; edited 1 time in total

baddog2010
DD-WRT Novice

Joined: 10 Aug 2018
Posts: 17

Posted: Wed Sep 19, 2018 1:59 Post subject:

This is likely the wrong place but wanted this groups opinion. I'm going to upgrade from TPLink to another router. What device might be recommended. Seems many use the ASUS RT-N66U. Service is General/Moderate use, maximum 2-3 pc's, a few security cameras, occasional Roku use. I have a DLink DIR 879 but has no USB, no YAMon, no Linklogger. I like the speed of the DIR-879 over the TP-Link. TP-Link has YAMon, LinkLogger(demo) and monitors all devices. Connection Layout is Security cams to Ampedwireless,all devices to TP-Link, TP-Link to Hughesnet,Hughesnet router to inet. According to Hughesnet I cannot replace the Hughesnet router.
Suggestions please.

@m0eb@
DD-WRT User

Joined: 26 Dec 2015
Posts: 289

Posted: Sat Sep 22, 2018 18:13 Post subject:
New user to YaMon dd-wrt build 36840 (Kong) Router R6400v2 YaMon version 3.4.5 I am getting an entry UN:KN:OW:N0:0M:AC with IPv4 address 0.0.0.0_0, device Name "No Matching MAC" ... which has consumed 32.3% (1.6GB) of my data in past 2-3 days. Is someone hacking into my router?

bushant
DD-WRT Guru

Joined: 18 Nov 2015
Posts: 2036

Posted: Sat Sep 22, 2018 18:33 Post subject:

@m0eb@ wrote:

I am getting an entry UN:KN:OW:N0:0M:AC with IPv4 address 0.0.0.0_0, device Name "No Matching MAC" ... which has consumed 32.3% (1.6GB) of my data in past 2-3 days.

Is someone hacking into my router?

The answer is in the help section at http://usage-monitoring.com/help/ It's kinda long.
_________________
Forum Guide Lines (with helpful pointers about how to research your router, where and what firmware to download, where and how to post and many other helpful tips!)
How to get help the right way
Before asking for help - Read the forum guidelines AND Upgrade DD-WRT!
Adblock by eibgrad (1.1M blocked) + Blocklist Collection

@m0eb@
DD-WRT User

Joined: 26 Dec 2015
Posts: 289

Posted: Sun Sep 23, 2018 2:22 Post subject:

bushant wrote:

The answer is in the help section at http://usage-monitoring.com/help/ It's kinda long.

Thanks.
I had been through most of this page before posting at dd-wrt forum since most issues in this page end with the comment shown below. I did see some comments about not using Privoxy, uPNP and disabling SFE. Those did not work. Also - several places, several people have referred to similar issues but there is no clear answer anywhere. Some references to manually overwriting the files ... did that, but it had no effect. This post was made after I had tried all that and failed.

scrap.PNG

Description:

Filesize:

9.75 KB

Viewed:

2379 Time(s)

bushant
DD-WRT Guru

Joined: 18 Nov 2015
Posts: 2036

Posted: Sun Sep 23, 2018 16:01 Post subject:

Well the way I read this:

Code:

Why is there a device named `No Matching MAC` in my reports?

It is al_c's way of making YAMon3 agree with your router's reporting more better.
_________________
Forum Guide Lines (with helpful pointers about how to research your router, where and what firmware to download, where and how to post and many other helpful tips!)
How to get help the right way
Before asking for help - Read the forum guidelines AND Upgrade DD-WRT!
Adblock by eibgrad (1.1M blocked) + Blocklist Collection

Llaves
DD-WRT Novice

Joined: 11 Aug 2018
Posts: 17

Posted: Tue Oct 02, 2018 17:39 Post subject: h2m.sh arithmetic errors on line 172

I'm trying to fill the gaps in my monthly data by running h2m.sh.
Here's what I get:

Code:

Processing data files for billing interval: 2018-09-24
>>> saving to: /opt/YAMon3/data/2018/09/2018-09-mac_data2.js
2018-09-24
PND: .........................
Hourly: .........
2018-09-25
PND: .........................
Hourly: ............
2018-09-26
PND: .........................
Hourly:
2018-09-27
PND: .........................
Hourly: ...........
2018-09-28
PND: .........................
Hourly: ...........
2018-09-29
PND: .........................
Hourly: .........
2018-09-30
PND: ......
Hourly: .........
/opt/YAMon3/h2m.sh: line 172: arithmetic syntax error

I'm running DD-WRT v3 r37012 (9/21/2018)
Thoughts of what to try next?

BarkingSpider
DD-WRT User

Joined: 29 Jan 2014
Posts: 98

Posted: Tue Oct 02, 2018 23:09 Post subject:

BarkingSpider wrote:

al_c wrote:

BarkingSpider wrote:

al_c wrote:

BarkingSpider wrote:

Can you send me your users.js... it could be a regex is too liberal and is matching multiple entries...

Please zip and send the file to questions@usage-monitoring.com

thx

users.js file has been sent.

I set the loglevel=0 and restarted YAMon. I can send you the log file, but here is a snip of the error:
15:48:27 0 update
15:48:27 0 lostBytes: !!! No matching entry in _currentUsers for 00:0c:29:82:0a:bd / 169.254.255.1 (169\.254\.255\.1)?!? - adding 944 to unknown mac
192.168.1.115,225,256
192.168.1.135,2682,830
192.168.1.103,0,60
73.239.111.174,622,1356
169.254.255.1,0,944 944
15:48:27 2 !!! No matching entry in _currentUsers for 00:0c:29:82:0a:bd / 169.254.255.1 (169\.254\.255\.1)?!? - adding 944 to unknown mac
192.168.1.115,225,256
192.168.1.135,2682,830
192.168.1.103,0,60
73.239.111.174,622,1356
169.254.255.1,0,944 (_totalLostBytes=944 / 944)

My users.js has an entry for that MAC
ud_a({"mac":"00:0c:29:82:0a:bd","ip":"192.168.1.126","ip6":"","owner":"VM","name":"MI666","colour":"","added":"2018-08-29 15:47:29","updated":"2018-08-29 15:47:29","last-seen":"2018-08-29 15:47:29"})
_________________
Netgear R7800: DD-WRT v3.0-r47822 std (12/09/21)
Linksys wrt1900acsV2: DD-WRT v3.0-r47822 std (12/09/21)

Goto page Previous 1, 2, 3 ... 15, 16, 17 ... 44, 45, 46 Next

Display posts from previous:

Page 16 of 46

DD-WRT Forum Index -> General Questions

All times are GMT

Navigation

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum

Log in

YAMon 3.4 - usage monitoring for your router

Quick Links

Log in