Posted: Tue Oct 02, 2018 23:35 Post subject: h2m.sh arithmetic errors on line 172
A partial answer to my question above.
Line 172 reads:
Code:
nm=$(($rMonth+1))
If you change this to
Code:
nm=$(expr "$rMonth" + 1)
The script runs without error. However, the same error almost certainly exists elsewhere in the script for periods that span years or other conditions.
I'll leave it for someone who actually understands the script to fix those
Posted: Sat Oct 13, 2018 23:06 Post subject: Iptables clean-up?
(Posting again, as I put it on the old thread...)
I (unfortunately) had to remove YAMon from my router (Netgear R7800). I followed the instructions for fully removing YAMon, but when I took a look at my Iptables I found no reference to YAMon at all.
How can I make sure my Iptables are back to their default setting?
Posted: Sun Oct 14, 2018 13:08 Post subject: Bridging Question
Hi Al,
I had a question about bridging. I'm overseas for a few years (work related) but as a result I've had to bridge some of my devices. I also took the opportunity to upgrade to Yamon 3.4.5. These devices (mostly server VMs have assigned IPs) but right now show up as Bridged MAC. Another bug/issue likely a corrupted users.js causes Yamon to crap out with my original file.
That said, if I understand the documentation correctly, I can update users.js to assinged the br:id:ge:dm:ac-1 to the proper mac and keep the same IP, then all should be well and my bridged device will appear with the proper name and MAC, provided the IP remains the same correct?
I'll test it later but since it's actively being used I don't want to restart YAMon right now, and thought maybe I'd get an answer before I do.
This also led me to think, if I have two only bridged devices that don't have assigned IPs, it's possible then that traffic flow can get incorrectly assigned, right?
Consider:
Monday:
Code:
D1 -- RM1 -- BM1 -- IP1
D2 -- RM2 -- BM2 -- IP2
Wednesday
Code:
D1 -- RM1 -- BM2 -- IP2
D2 -- RM2 -- BM1 -- IP1
Where D -> Device, RM -> Real MAC, BM - Bridged MAC, and IP - IP Address.
Do I understand the inner workings correctly? Is this a function of the limitations of iptables?
Also is a permanent solution to this to ensure that bridge devices always have assigned IPs?
Al, I'm still trying to track down this weird problem with "No matching entry" for one of my mac addresses. I did set loglevel=0 and let run for about 30 minutes, so if you need that, I can send. Here is a one minute snip below. I cut out some of entries to make this short. ALSO...I noticed in my users.js that this mac entry I'm having trouble with IS THE LAST ENTRY in the users.js ... followed by a blank line too.
What is really odd is I see this:
09:02:07 2 !!! No matching entry in _currentUsers for 00:0c:29:82:0a:bd / 192.168.1.1 (192\.168\.1\.1)?!? - adding 40 to unknown mac
and 30 seconds later:
09:02:38 0 lostBytes: !!! No matching entry in _currentUsers for 00:0c:29:82:0a:bd / 169.254.255.1 (169\.254\.255\.1)?!? - adding 944 to unknown mac
Here is the one minute snip:
09:02:07 0 checkIPs
09:02:07 0 >>> ip 4 list did not change
09:02:07 0 >>> ip 6 list did not change
09:02:07 0 updateUsage_1
09:02:07 0 updateUsage: iptables YAMON34v4
09:02:07 0 add2UDList: 192.168.1.120 3397685 0
09:02:07 0 add2UDList: 192.168.1.120 0 25897
09:02:07 0 add2UDList: 192.168.1.1 40 0
09:02:07 0 _ud_list-->
192.168.1.120,3397685,25897
192.168.1.1,40,0
09:02:07 0 update
09:02:07 0 getField: ud_a({"mac":"00:0c:29:82:0a:bd","ip":"192.168.1.120","ip6":"","owner":"VM","name":"AE668463","colour":"","added":"2018-08-29 15:47:29","updated":"2018-10-15 08:21:30","last-seen":"2018-08-29 15:47:29"}) / mac=00:0c:29:82:0a:bd
09:02:07 0 getCV: hu({"mac":"00:0c:29:82:0a:bd","hour":"09","down":24881522,"up":228326}) / down=24881522
09:02:07 0 getCV: hu({"mac":"00:0c:29:82:0a:bd","hour":"09","down":24881522,"up":228326}) / up=228326
09:02:07 0 updated ul row-->hu({"mac":"00:0c:29:82:0a:bd","hour":"09","down":28279207,"up":254223})
09:02:07 0 update
09:02:07 0 lostBytes: !!! No matching entry in _currentUsers for 00:0c:29:82:0a:bd / 192.168.1.1 (192\.168\.1\.1)?!? - adding 40 to unknown mac
192.168.1.120,3397685,25897
73.239.111.174,1298,866
192.168.1.1,40,0 40
09:02:07 2 !!! No matching entry in _currentUsers for 00:0c:29:82:0a:bd / 192.168.1.1 (192\.168\.1\.1)?!? - adding 40 to unknown mac
192.168.1.120,3397685,25897
73.239.111.174,1298,866
192.168.1.1,40,0 (_totalLostBytes=40 / 40)
09:02:07 0 update
09:02:07 0 getField: ud_a({"mac":"un:kn:ow:n0:0m:ac","ip":"0.0.0.0/0","ip6":"::/0","owner":"Unknown","name":"New Device-14","colour":"","added":"2018-04-11 10:40:48","updated":"2018-04-11 10:40:48","last-seen":"2018-04-11 10:40:48"}) / mac=un:kn:ow:n0:0m:ac
09:02:07 1 new ul row-->hu({"mac":"un:kn:ow:n0:0m:ac","hour":"09","down":40,"up":0})
09:02:07 0 updateUsage: ip6tables YAMON34v6
09:02:37 0 checkIPs
09:02:37 0 >>> ip 4 list changed ->
192.168.1.120 00:0c:29:82:0a:bd
73.239.111.1 00:87:31:90:d8:22
Al, I'm still trying to track down this weird problem with "No matching entry" for one of my mac addresses. I did set loglevel=0 and let run for about 30 minutes, so if you need that, I can send. Here is a one minute snip below. I cut out some of entries to make this short. ALSO...I noticed in my users.js that this mac entry I'm having trouble with IS THE LAST ENTRY in the users.js ... followed by a blank line too.
What is really odd is I see this:
09:02:07 2 !!! No matching entry in _currentUsers for 00:0c:29:82:0a:bd / 192.168.1.1 (192\.168\.1\.1)?!? - adding 40 to unknown mac
and 30 seconds later:
09:02:38 0 lostBytes: !!! No matching entry in _currentUsers for 00:0c:29:82:0a:bd / 169.254.255.1 (169\.254\.255\.1)?!? - adding 944 to unknown mac
Here is the one minute snip:
09:02:07 0 checkIPs
09:02:07 0 >>> ip 4 list did not change
09:02:07 0 >>> ip 6 list did not change
09:02:07 0 updateUsage_1
09:02:07 0 updateUsage: iptables YAMON34v4
09:02:07 0 add2UDList: 192.168.1.120 3397685 0
09:02:07 0 add2UDList: 192.168.1.120 0 25897
09:02:07 0 add2UDList: 192.168.1.1 40 0
09:02:07 0 _ud_list-->
192.168.1.120,3397685,25897
192.168.1.1,40,0
09:02:07 0 update
09:02:07 0 getField: ud_a({"mac":"00:0c:29:82:0a:bd","ip":"192.168.1.120","ip6":"","owner":"VM","name":"AE668463","colour":"","added":"2018-08-29 15:47:29","updated":"2018-10-15 08:21:30","last-seen":"2018-08-29 15:47:29"}) / mac=00:0c:29:82:0a:bd
09:02:07 0 getCV: hu({"mac":"00:0c:29:82:0a:bd","hour":"09","down":24881522,"up":228326}) / down=24881522
09:02:07 0 getCV: hu({"mac":"00:0c:29:82:0a:bd","hour":"09","down":24881522,"up":228326}) / up=228326
09:02:07 0 updated ul row-->hu({"mac":"00:0c:29:82:0a:bd","hour":"09","down":28279207,"up":254223})
09:02:07 0 update
09:02:07 0 lostBytes: !!! No matching entry in _currentUsers for 00:0c:29:82:0a:bd / 192.168.1.1 (192\.168\.1\.1)?!? - adding 40 to unknown mac
192.168.1.120,3397685,25897
73.239.111.174,1298,866
192.168.1.1,40,0 40
09:02:07 2 !!! No matching entry in _currentUsers for 00:0c:29:82:0a:bd / 192.168.1.1 (192\.168\.1\.1)?!? - adding 40 to unknown mac
192.168.1.120,3397685,25897
73.239.111.174,1298,866
192.168.1.1,40,0 (_totalLostBytes=40 / 40)
09:02:07 0 update
09:02:07 0 getField: ud_a({"mac":"un:kn:ow:n0:0m:ac","ip":"0.0.0.0/0","ip6":"::/0","owner":"Unknown","name":"New Device-14","colour":"","added":"2018-04-11 10:40:48","updated":"2018-04-11 10:40:48","last-seen":"2018-04-11 10:40:48"}) / mac=un:kn:ow:n0:0m:ac
09:02:07 1 new ul row-->hu({"mac":"un:kn:ow:n0:0m:ac","hour":"09","down":40,"up":0})
09:02:07 0 updateUsage: ip6tables YAMON34v6
09:02:37 0 checkIPs
09:02:37 0 >>> ip 4 list changed ->
192.168.1.120 00:0c:29:82:0a:bd
73.239.111.1 00:87:31:90:d8:22
Update:
I move an entry in my users.js that has "un:kn:ow:n0:0m:ac" to the bottom (with blank after of course) and .... the problem changed to that mac now, so I think this has something to do with the last entry in the users.js file.
14:41:06 99 YAMon was started
14:41:07 1 >>> Delaying 23s to align updates
14:41:07 1 >>> Starting main loop
14:53:09 2 !!! No matching entry in _currentUsers for un:kn:ow:n0:0m:ac / 169.254.255.1 (169\.254\.255\.1)?!? - adding 944 to unknown mac
192.168.1.125,313,291
192.168.1.135,13957,4330
192.168.1.169,0,180
73.239.111.174,437,385
169.254.255.1,0,944 (_totalLostBytes=944 / 944) _________________ Netgear R7800: DD-WRT v3.0-r47822 std (12/09/21)
Linksys wrt1900acsV2: DD-WRT v3.0-r47822 std (12/09/21)
Posted: Wed Oct 17, 2018 1:31 Post subject: Is This Normal Router WAN Traffic?
Router: R7000 with Kong r36070M and YAMon 3.4.5
Quote:
I hope this is the place to ask a question about what YAMon is showing me about my router. I have a Netgear R7000 router with Kong 36070M firmware installed running YAMon 3.4.5. I am monitoring the usage of the various devices on my network. My question is what would cause my router WAN, this is my router MAC address for the WAN not a device on my network, to have approximately thirty different UPD ports open to Midco Cable in Sioux Falls SD? This is not my service provider. My question is why all the open UDP ports and why to this address. Finally, is YAMon the best tool to understand why this is happening or should I be using something else?
I’m sorry for the repost here but I’ve received a couple of mixed responses to my original post that I quoted above.
Some responses said this is normal DNS port 53 traffic, nothing to worry about. Another person said my router setup for DNSMasq was wrong but couldn’t tell me how to fix it. Still another person said I have a virus.
I’m hoping that someone who has experienced something like this before or has helpful knowledge of network trafficking or DNSMasq can help me determine whether this is truly a problem or normal router operations.
Up to this point I’ve ran all the virus checkers and malware programs I can find again my devices and haven’t found any problem. I’ve also ran a number of open port scanners against my router and none were ever found to be open.
I’m open to suggestions. If you know of anything that might help I would appreciate the advice.
Posted: Wed Oct 17, 2018 5:31 Post subject: Re: Is This Normal Router WAN Traffic?
JosephAE wrote:
Router: R7000 with Kong r36070M and YAMon 3.4.5
Quote:
I hope this is the place to ask a question about what YAMon is showing me about my router. I have a Netgear R7000 router with Kong 36070M firmware installed running YAMon 3.4.5. I am monitoring the usage of the various devices on my network. My question is what would cause my router WAN, this is my router MAC address for the WAN not a device on my network, to have approximately thirty different UPD ports open to Midco Cable in Sioux Falls SD? This is not my service provider. My question is why all the open UDP ports and why to this address. Finally, is YAMon the best tool to understand why this is happening or should I be using something else?
I’m sorry for the repost here but I’ve received a couple of mixed responses to my original post that I quoted above.
Some responses said this is normal DNS port 53 traffic, nothing to worry about. Another person said my router setup for DNSMasq was wrong but couldn’t tell me how to fix it. Still another person said I have a virus.
I’m hoping that someone who has experienced something like this before or has helpful knowledge of network trafficking or DNSMasq can help me determine whether this is truly a problem or normal router operations.
Up to this point I’ve ran all the virus checkers and malware programs I can find again my devices and haven’t found any problem. I’ve also ran a number of open port scanners against my router and none were ever found to be open.
I’m open to suggestions. If you know of anything that might help I would appreciate the advice.
Under normal circumstances the answer could have been any of the thins that were suggested to you. That said you did the additional leg work of scanning ports. As you can see these are all going to UDP Port 53, which is primarily used by DNS. There is one known trojans that also use Port 53, but they use TCP not UDP. This plus the additional due diligence you did to scan your devices should let you sleep easier at night.
On the question on why this is happening, the other two answers are correct. It's normal DNS traffic and router operations. As a response to one of your other posts noted, the number ports open can result from a sudden flurry of activity such as resuming a computer from sleep or restoring a browser from lots of tabs. It's likely the that server is one the closest/most knowledgeable DNS server close to you.
The suggestion that DNSMasq is set up incorrectly is a bit misleading. It could be true, if you configured your DNSMasq to only use you dictated and dedicated DNS and to also force all devices to use the DNS you specified but doesn't necessarily have to be the case. Yes you likely can have a more efficient set up, but if all you're web requests are resolving in a timely manner, you are fine.
However, if you are still uncomfortable with it. You can explicitly block that traffic with the following iptables command in your firewall rules.
Code:
iptables -A OUTPUT -p udp -d 24.217.0.3 --dport 53 -j DROP
Posted: Thu Oct 18, 2018 13:38 Post subject: Re: Bridging Question
VTecheira wrote:
That said, if I understand the documentation correctly, I can update users.js to assinged the br:id:ge:dm:ac-1 to the proper mac and keep the same IP, then all should be well and my bridged device will appear with the proper name and MAC, provided the IP remains the same correct?
So to answer my own question a bit, what needs to be done is not just updating users.js (that only let's the device be known.) What you need to do is update the hourly data files as well.
Do this with caution if you wireless bridge IPs are not static, because you could end up misattributing data if the bridge lease went to another device.
Code:
sed -i -e 's/br:id:ge:dm:ac-1/th:em:ac:iw:an:t1/' 2018-10-14-hourly_data.js
You may have to clear your browser cache if you already visited the report page.
Netgear Nighthawk X10
DD-WRT v3.0-r37415M std (10/17/1
Linux 4.9.133 #29 SMP PREEMPT Wed Oct 17 23:41:02 CEST 2018 armv7l
seems like some issue with iptop I think ...
although it seems everything works fine..
It seems a function that Al uses was left out of the busybox ip compilation. Don't know if it will be corrected or not. _________________ Segment 1 XR700 10Gb LAN, 1Gb WAN ISP BS
Wired AP 1 Unifi Wifi 6 LR US 1Gb LAN
Wired AP 2 Unifi Wifi 6 LR US 1Gb LAN
Wired AP 3 Unifi Wifi 6 LR US 1Gb LAN
Syslog Services Asustor 7110T NAS 10GB
NetGear XS716T 10GB Switch
download1.dd-wrt.com/dd-wrtv2/downloads/betas/ (Brain Slayer)
YAMon https://usage-monitoring.com/index.php
Some busybox versions stop providing and YAMon needs it to function. You can load a full version of ip (e.g. I used Kongs opkg) and then specify the location in the config. Look at parameter
Code:
_path2ip='/opt/usr/sbin/ip' # path to full version of `ip` (* default `ip` or `/opt/sbin/ip`)
Some busybox versions stop providing and YAMon needs it to function. You can load a full version of ip (e.g. I used Kongs opkg) and then specify the location in the config. Look at parameter
Code:
_path2ip='/opt/usr/sbin/ip' # path to full version of `ip` (* default `ip` or `/opt/sbin/ip`)
thank you that seem to have done the trick.
installed entware and set the correct path to ip in yamon now.
much appreciated.
Hi, I have version 3.4.5 installed but I do not register almost any data, 90% of the traffic I figure as if it were the router and not the equipment.
I installed live data, downloaded a 100mb file and did not show it to me as if I downloaded it.
in the "Daily Usage Report" section
in the total of the equipment I figure 35.8mb and below says Measured @ Router: 7.0GB
So I'm not measuring the equipment but all the traffic as if it were the router.
I know that i need to disable "Shortcut Forwarding Engine", but the problem its when i disable this option all the acces restriction rules dosent work.
So I'm not measuring the equipment but all the traffic as if it were the router.
I know that i need to disable "Shortcut Forwarding Engine", but the problem its when i disable this option all the acces restriction rules dosent work.
SFE bypasses the router functions YAMon needs to work correctly. The choice is yours. _________________ Segment 1 XR700 10Gb LAN, 1Gb WAN ISP BS
Wired AP 1 Unifi Wifi 6 LR US 1Gb LAN
Wired AP 2 Unifi Wifi 6 LR US 1Gb LAN
Wired AP 3 Unifi Wifi 6 LR US 1Gb LAN
Syslog Services Asustor 7110T NAS 10GB
NetGear XS716T 10GB Switch
download1.dd-wrt.com/dd-wrtv2/downloads/betas/ (Brain Slayer)
YAMon https://usage-monitoring.com/index.php
