How to show network connections of all processess in realtime?

[jarmka]

How does one show connections of all processes in the AsusWRT Merlin? I've tried ss, bmon, iftop, netstat, netstat-nat... none of them allow for real-time monitoring of processes and their connections. Anybody know how to do this in Merlin? Thank you...

 

[Xentrk]

How does one show connections of all processes in the AsusWRT Merlin? I've tried ss, bmon, iftop, netstat, netstat-nat... none of them allow for real-time monitoring of processes and their connections. Anybody know how to do this in Merlin? Thank you...

ntopng is probably the best tool for that. I describe how I did it here. Been awhile since I looked at it. You can slice and dice the information in many ways.

 

[jarmka]

@Xentrk, I have tried ntop before for traffic monitoring on my desktop; I don't understand how it can monitor global router traffic & processes without installing anything on the router itself. If that is so I may consider giving this a try; I've been encountering problems installing SQL so I may have to use a VM. Though I do prefer something lightweight that can run directly on the router itself. Thanks so much for the info.

 

[Twiglets]

@Xentrk, I have tried ntop before for traffic monitoring on my desktop; I don't understand how it can monitor global router traffic & processes without installing anything on the router itself. If that is so I may consider giving this a try; I've been encountering problems installing SQL so I may have to use a VM. Though I do prefer something lightweight that can run directly on the router itself. Thanks so much for the info.

In a nutshell it is 'sucking' the packets straight off the network and classifying them.
You will/can catch all traffic between the router and the devices on your network.
Looks very snazzy & useful as well
Interfaces with things like snort & wireshark, if you already use those.
Very useful L7 classification for a nice overview of who is accessing what.
i.e. Which devices are using Whatsapp or GoogleDocs or Skype or whatever is of interest

May have a dabble myself for the fun of it !!!

 

[Xentrk]

ntopng is a an available package on pfSense. So real easy to get working on that firmware. Not sure if the entware team has plans to include it in the future. I recall hitting a roadblock on getting it to work on Windows 10. But the Ubuntu method worked fine. I was able to google my way thru it.

 

[jarmka]

That is really snazzy. While it definitely is something I'd like to test my primary concern is monitoring the processes on the Router itself in real time, and not so much the packet data from clients, to get a better idea of how the router functions and what processes are responsible for sending out probes and querys to the great wide web.