how to track user activity ?

RouterOS General
1

Hi all.
My users enter in the subscriber by a pppoe connection and receive a public ip.
I have queue tree managemnt to ensure QoS.
I check the user bandwidth reading tx/rx from interface pppoe-username.
Then if I perform a torch in this interface I can see a lot of traffic and connections
…BUT
if I print all the /ip firewall connections (to see how the user traffic is mangled), I cannot find any connection to/from the same public ip…

Is this normal ?
You can say: use torch!
But in this case I cannot see how each connection in mangled.

Some tips ?

thanks

2

Maybe it is all UDP traffic?

3

But UDP traffic is mangled and connections are tracked.
And if I torch the user I see TCP connections.

4

When I open ‘Connections’ tab, I see ‘2052 of 5xxx’ in status bar… And I cannot see all user’s connections even when Filter is active… Is this issue with Connections viewing, or it’s normal behaviour?..

5

I think it is normal.
I can see all 5xxx connections if you print them by / ip firewall connection print file=conn.txt or (api) /ip/firewall/connection/getall.