Analyze Local Network Traffic, Update Quota with tshark and BASH

Question

I have a slightly weird problem and I really hope someone can help with this:

I go to university and the wireless network here issues every login a certain quota/week (mine is 2GB). This means that every week, I am only allowed to access 2GB of the Internet - my uploads and downloads together must total at most 2GB (I am allowed access to a webpage that tells me my remaining quota). I'm usually allowed a few grace KB but let's not consider that for this problem.

My laptop runs Ubuntu and has the conky system monitor installed, which I've configured to display (among other things, ) my remaining wireless quota. Originally, I had conky hit the webpage and grep for my remaining quota. However, since my conky refreshes every 5 seconds and I'm on the wireless connection for upwards of 12 hours, the checking of the webpage itself kills my wireless quota.

To solve this problem, I figured I could do one of two things:

1. Hit the webpage much less frequently so that doing so doesn't kill my quota.
2. Monitor the wireless traffic at my wireless card and keep subtracting it from 2GB

(1) is what I've done so far: I setup a cron job to hit the webpage every minute and store the result in file on my local filesystem. Conky then reads this file - no need for it to hit the webpage; no loss of wireless quota thanks to conky.

This solution is a win by a factor of 12, which is still not enough. However, I'm a fan of realtime data and will not reduce the cron frequency further.

So, the only other solution that I have is (2). This is when I found out about wireshark and it's commandline version tshark. Now, here's what I think I should do:

1. daemonize tshark
2. set tshark to monitor the amount (in KB or B or MB - I can convert this later) of traffic flowing through my wireless card
3. keep appending this traffic information to file1
4. sum up the traffic information in the file1 and subtract it from 2GB. Store the result in file2
5. set conky to read file2 - that is my remaining quota
6. setup a cron job to delete/erase_the_contents_of file1 every Monday at 6.30AM (that's when the weekly quota resets)

At long last, my questions:

1. Do you see a better way to do this?
2. If not, how do I setup tshark to make it do what I want? What other scripts might I need?

If it helps, the website tells me my remaining quota is KB

I've already looked at the tshark man page, which unfortunately makes little sense to me, being the network-n00b that I am.

Thank you in advance.

Answer 1

Interesting question. I've no experience using tshark, so personally I would approach this using iptables.

Looking at:

[root@home ~]# iptables -nvxL | grep -E "Chain (INPUT|OUTPUT)"
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
Chain OUTPUT (policy ACCEPT 9763462 packets, 1610901292 bytes)

we see that iptables keeps a tally of the the bytes that passes through the each chain. So one can presumably go about monitoring your bandwidth usage by:

1. When your system starts up, retrieve your remaining quota from the web
2. Zero the byte tally in iptables (Use the -z option)
3. Every X seconds, get usage from iptables and deduct from quota

Here are some examples of using iptables for IP accounting.

Caveats

There are some drawbacks to this approach. First of all you need root access to run iptables, which means you need conky running as root, or run a cron daemon which writes the current values to a file which conky has access to.

Also, not all INPUT/OUTPUT packets may count towards your bandwidth allocation, e.g. intranet access, DNS, etc. One can filter out only relevant connections by matching them and placing them in a separate iptables chain (examples in the link given above). An easier approach (if the disparity is not too large) would be to occasionally grab your real time quota from the web, reset your values and start again.

It also gets a little tricky when you have existing iptables rules which are either complicated or uses custom chains. You'll then need some knowledge of iptables to retrieve the right values.