I am having some trouble with excessive internet data usage by my home devices. The problem is I cant figure out which device is using up all my data.

I do have a raspberry pi that's always on. My plan is to connect the pi via ethernet to the access point and then set up a hotspot on the pi so that all my home appliances will connect to the pi's hotspot.

Then, since all the internet traffic will flow through the pi's hotspot, i feel like there has to be some way to monitor the data usage per device using the pi..

In my research, I've found Wireshark but that seems to be overkill and inefficient for this use case. (Not to mention quite complicated).

Some sites suggest ntop but i don't know whether it will work.

Tcpdump: also seems really complicated and overkill.

Any suggestions on what i can use? (My router does not have usage motoring capabilities and I don't want to buy a router). I can live with a small bottleneck caused by the pi's poor networking hardware

1 Answer 1


First you need a way to identify your devices so you'll know which is which. Some newer mobile devices will randomize their MAC address for privacy reasons, unless you specifically configure them to trust a particular network enough to use their factory default MAC address with it.

Having static MAC addresses is usually enough to keep the IP addresses more or less stable on its own, but you could configure your RasPi hotspot's DHCP server to always give specific static IP addresses to each client, by their MAC addresses.

Once you have clients using known IP addresses, you could add your own iptables rule chain with two rules per device to act as packet/byte counters, like this:

iptables -N packetcount   # create a custom rule chain
iptables -A packetcount -s <device IP> -o <wired interface> -j RETURN -m comment --comment "FROM <device name>"
iptables -A packetcount -i <wired interface> -d <device IP> -j RETURN -m comment --comment "TO <device name>"
[...add a pair of rules for each device...]

Then, add this custom chain as the first rule in the FORWARD standard rule chain:

iptables -I FORWARD 1 -j packetcount

Now you'll have a set of packet/byte counters for incoming and outgoing data for each device, which you can read with:

iptables -L packetcount -vn

(Using the -n option here makes the command not spend time trying to resolve the IPs into hostnames, and the -m comment --comment ... earlier causes a nice human-readable name to appear for each counter anyway.)

The listing will be wider than 80 characters, so use a wide terminal window to view it. The first two columns in the listing will be the number of packets and the total number of bytes matched by the rule.

And if you want to zero the counters (e.g. once a day after reading them), you can do it with:

iptables -Z packetcount

For maximal accuracy, you can combine the listing and zeroing, so that each counter will be listed immediately before zeroing it:

iptables -Z packetcount -L -vn
  • thank you! I am rather new to this.. I will try what you suggested. Is there any way to use ntopng to do this if I install it on the raspberry pi? I'm trying it out and I the web gui seems nice.
    – mahela007
    Feb 4 at 12:07
  • 1
    In my opinion, ntopng looks overkill for what you initially asked, but if you think having experience in setting it up would be a good thing for you, go for it. An early model RasPi might not be powerful enough for handling both the traffic and the ntopng software together, though... if you have one of the later models, then maybe it would be enough.
    – telcoM
    Feb 4 at 12:50
  • I see. I don't have much experience with it but I tried installing it on a local PC and the GUI seemed appealing. I also need to clarify one more thing: If ntopng is installed on one node of the wan network, can it monitor traffic to and from the other nodes? (i.e if A,B,and C connect to a router, can ntopng installation on A gather information about packets between C and the router?)
    – mahela007
    Feb 4 at 14:03
  • It would require some way for the ntopng to pull information from the router (e.g. via SNMP), or for complete analysis, have the router send a copy of all the traffic (or at least the packet headers) to the ntopng host. See this page in ntopng documentation.
    – telcoM
    Feb 4 at 15:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .