Examining my home network traffic
Discussion
Is there a piece of ideally free software I can use to examine the traffic and errors on my network? Ideally something that intelligently studies the traffic and tells me in reasonably plain English if there is anything wrong or that should be looked at.
My network consists of:
AirPort Extreme as dhcp server
Cat 6 cabling everywhere hanging of an unmanaged 24 port gigabit switch
8 Sonos speakers
8 8mp cctv cameras
Probably 10 phones, idads, computers etc
Smart tv.
There are lots of each of these connected via Wi-Fi.
Suppose the tv is constantly pinging a server or downloading stuff. At the moment I wouldn’t have a clue, so I’m thinking some intelligent analysis of the network traffic would be useful.....
My network consists of:
AirPort Extreme as dhcp server
Cat 6 cabling everywhere hanging of an unmanaged 24 port gigabit switch
8 Sonos speakers
8 8mp cctv cameras
Probably 10 phones, idads, computers etc
Smart tv.
There are lots of each of these connected via Wi-Fi.
Suppose the tv is constantly pinging a server or downloading stuff. At the moment I wouldn’t have a clue, so I’m thinking some intelligent analysis of the network traffic would be useful.....
Good question, I'm capable of reading Wireshark output but that is not something that can be considered "plain english". If there's something quick and easy then I'd give it a go as the audio drops on MS Teams are getting very annoying and seem to appear with or without kids watching youtube and with consistent good ping times to various random public servers. Might just be MS, but would be good to rule out local noise.
Do you have any reason to suspect that something nefarious may be going on?
Short of buying something like a UniFi edge gateway, I’d start with setting up Pihole and redirecting all your local DNS requests to this. You’ll then get network wide ad blocking as a bonus (this is ace), but you can see what the top requests of each client are. It’s also made my smart TV run a lot better as it blocks all the crap Samsung try to push to it.
You’ll need to setup Pihole and change the DHCP scope that your router is giving out to give out the new DNS server.
Short of buying something like a UniFi edge gateway, I’d start with setting up Pihole and redirecting all your local DNS requests to this. You’ll then get network wide ad blocking as a bonus (this is ace), but you can see what the top requests of each client are. It’s also made my smart TV run a lot better as it blocks all the crap Samsung try to push to it.
You’ll need to setup Pihole and change the DHCP scope that your router is giving out to give out the new DNS server.
Rojibo said:
Do you have any reason to suspect that something nefarious may be going on?
Short of buying something like a UniFi edge gateway, I’d start with setting up Pihole and redirecting all your local DNS requests to this. You’ll then get network wide ad blocking as a bonus (this is ace), but you can see what the top requests of each client are. It’s also made my smart TV run a lot better as it blocks all the crap Samsung try to push to it.
You’ll need to setup Pihole and change the DHCP scope that your router is giving out to give out the new DNS server.
No reason to suspect anything nefarious, more that since lockdown I’ve massively increased the number of devices on the network and sometimes cctv connections drop, Sonos gives server errors or my work vpn seems slow. That sort of thing...Short of buying something like a UniFi edge gateway, I’d start with setting up Pihole and redirecting all your local DNS requests to this. You’ll then get network wide ad blocking as a bonus (this is ace), but you can see what the top requests of each client are. It’s also made my smart TV run a lot better as it blocks all the crap Samsung try to push to it.
You’ll need to setup Pihole and change the DHCP scope that your router is giving out to give out the new DNS server.
MrCheese said:
No reason to suspect anything nefarious, more that since lockdown I’ve massively increased the number of devices on the network and sometimes cctv connections drop, Sonos gives server errors or my work vpn seems slow. That sort of thing...
What router, broadband and Wifi setup do you have ?There are no simple answers to this question. From a network monitoring perspective Observium is great and free.
From a security perspective you can get home firewalls with IPS these days that manages itself and alerts on detection. Sophos do a product and there are others.
The pi-hole is also a good shout, it’s a DNS Adblocker but can also reveal other DNS based problems.
Going deeper into the subject will require far more experience and knowledge, it’s absolutely not insurmountable but you’d need to be prepared to put the time and effort into learning it.
From a security perspective you can get home firewalls with IPS these days that manages itself and alerts on detection. Sophos do a product and there are others.
The pi-hole is also a good shout, it’s a DNS Adblocker but can also reveal other DNS based problems.
Going deeper into the subject will require far more experience and knowledge, it’s absolutely not insurmountable but you’d need to be prepared to put the time and effort into learning it.
An update:
I got a raspberry pi and am now running pihole. It’s interesting, I do have lots of Sonos, Amazon and google blocked dns requests. I clearly also need to cut back on the daily mail
My setup is plusnet internet, an apple extreme router/dhcp server, bt whole home mesh Wi-Fi.
I think I also need to be running something on the pi that tells me what is happening on the Wi-Fi network as it isn’t clear to me whether there are any problems on wireless devices. For example, my mixed Ethernet/Wi-Fi cctv system does drop connections, I’m not sure whether I’m overloading the Wi-Fi network.
I got a raspberry pi and am now running pihole. It’s interesting, I do have lots of Sonos, Amazon and google blocked dns requests. I clearly also need to cut back on the daily mail
My setup is plusnet internet, an apple extreme router/dhcp server, bt whole home mesh Wi-Fi.
I think I also need to be running something on the pi that tells me what is happening on the Wi-Fi network as it isn’t clear to me whether there are any problems on wireless devices. For example, my mixed Ethernet/Wi-Fi cctv system does drop connections, I’m not sure whether I’m overloading the Wi-Fi network.
MrCheese said:
An update:
I think I also need to be running something on the pi that tells me what is happening on the Wi-Fi network as it isn’t clear to me whether there are any problems on wireless devices. For example, my mixed Ethernet/Wi-Fi cctv system does drop connections, I’m not sure whether I’m overloading the Wi-Fi network.
That kind of requirement starts needing managed switches and wifi APs that support SNMP, and as someone mentioned, something like Observium (which ran tolerably on a Pi last time I did it). Not cheap in time or money.I think I also need to be running something on the pi that tells me what is happening on the Wi-Fi network as it isn’t clear to me whether there are any problems on wireless devices. For example, my mixed Ethernet/Wi-Fi cctv system does drop connections, I’m not sure whether I’m overloading the Wi-Fi network.
MrCheese said:
An update:
I got a raspberry pi and am now running pihole. It’s interesting, I do have lots of Sonos, Amazon and google blocked dns requests. I clearly also need to cut back on the daily mail
My setup is plusnet internet, an apple extreme router/dhcp server, bt whole home mesh Wi-Fi.
I think I also need to be running something on the pi that tells me what is happening on the Wi-Fi network as it isn’t clear to me whether there are any problems on wireless devices. For example, my mixed Ethernet/Wi-Fi cctv system does drop connections, I’m not sure whether I’m overloading the Wi-Fi network.
At the very least it’s quite satisfying blocking all the crap out. You’ll save on bandwidth to nonsense too. I got a raspberry pi and am now running pihole. It’s interesting, I do have lots of Sonos, Amazon and google blocked dns requests. I clearly also need to cut back on the daily mail
My setup is plusnet internet, an apple extreme router/dhcp server, bt whole home mesh Wi-Fi.
I think I also need to be running something on the pi that tells me what is happening on the Wi-Fi network as it isn’t clear to me whether there are any problems on wireless devices. For example, my mixed Ethernet/Wi-Fi cctv system does drop connections, I’m not sure whether I’m overloading the Wi-Fi network.
If you want to delve more into what your WiFi is doing you’re probably going to have to upgrade your hardware.
You can run the UniFi network controller on your Pi and get a UniFi access point, or two. Do you have much Ethernet cabling in your house? At the very least the controller and some UniFi access points would give you more info on client statistics/connections/performance, but it can get a bit pricey. My home network runs on a whole UniFi system, UDM-Pro as the router, 24 Port PoE switch and then WIFI AP pros. It’s been a little costly to set up but the WiFi is stable everywhere. (No matter how much I hate WiFi). 900 down 100 up, usually get about 300-400 on wireless devices, if they’re on the 5Ghz band.
Not sure I’d recommend the UDM pro however. It’s great when you get it working but UniFi seem to treat it as a bit of a beta product. Their WiFi products however are widely regarded as excellent
Thanks for the responses!
To answer some of the questions.
Yes I have an Apple TV connected.
My switched are all decent Netgear unmanaged POE gigabit.
I have absolutely loads of cat 6 Ethernet all over the house. I do try to hard wire as much as possible. In more than one place I have a single Ethernet from the main switch going to a remote location with a second unmanaged switch to connect multiple devices.
To answer some of the questions.
Yes I have an Apple TV connected.
My switched are all decent Netgear unmanaged POE gigabit.
I have absolutely loads of cat 6 Ethernet all over the house. I do try to hard wire as much as possible. In more than one place I have a single Ethernet from the main switch going to a remote location with a second unmanaged switch to connect multiple devices.
MrCheese said:
Thanks for the responses!
To answer some of the questions.
Yes I have an Apple TV connected.
My switched are all decent Netgear unmanaged POE gigabit.
I have absolutely loads of cat 6 Ethernet all over the house. I do try to hard wire as much as possible. In more than one place I have a single Ethernet from the main switch going to a remote location with a second unmanaged switch to connect multiple devices.
Try removing the Apple TV and seeing if that makes a difference.To answer some of the questions.
Yes I have an Apple TV connected.
My switched are all decent Netgear unmanaged POE gigabit.
I have absolutely loads of cat 6 Ethernet all over the house. I do try to hard wire as much as possible. In more than one place I have a single Ethernet from the main switch going to a remote location with a second unmanaged switch to connect multiple devices.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff