Hi,

I like Mikrotik, but how to monitor download and upload by IP adress? How to monitor realtime download and upload by IP? Torch is not really useful..

The Mikrotik app for android is good for monitoring wifi but not for LAN conection.

What? Its an excellent logging router from my experience.
Did you try packet sniffer for example??

How do you use packt sniffer for realtime traffic?

Hi,
I find actually it is quite good for monitoring.

You can look in the /ip firewall connections tab.
You can use simple queues. To see who (internally) is uploading/downloading stuff, and view current rates, and total bytes transferred, etc.
eg.

{
/queue simple
add name=qparent max-limit=500M/500M target="192.168.60.0/24"

:for x from 1 to 254 do={
:set name1 [("00" . $x)]; :set len1 [:len $name1];
:set name1 [:pick $name1 ($len1 - 3) 10]

:put $name1

/queue simple add name="q60-$name1" max-limit=500M/500M target="192.168.60.$x" \
parent="qparent"

}

}

You will need to either turn off fasttrack or don't fasttrack packets/connections that are entering or leaving via your WAN ports.

As other said , IP Firewalll connections page is very helpful, at least for a simple insight. Is something I didn’t find in any of my previous, ‘prosumer’ modem router.

Look at my Splunk for MikroTik project. See link in my signature.

I know about firewall/connection...do you really call this monitoring?? Is it really problem to make tool for real-time monitoring and toll for download and upload by IP? As I said Mikrotik is the worst monitoring router OS..

As I said Mikrotik is the worst monitoring router OS..

Compared to what exactly?

Just because you don't know how to use it, does not make it 'the worst'.

You can begin with some RTFM https://help.mikrotik.com/docs/

What is monitoring ? It goes from sniffer, over Touch (per connection), to Firewall filter, to web connections, to per IP traffic rates and volumes .... it's about instant values or history of logged consumption

Well some of this is in the "Hotspot". But there you need to login to the hotspot portal (human action). If you set "bypass" with IP-bindings the counters do not show up.
At least (Radius) accounting gives me a list for all IP addresses with WPA2/Enterprise. So some of this information is in 'User manager' (even if it is doing only the accounting)
Interface monitoring can be collected in DUDE (or other SNMP systems).

I'm not impressed with the MT "monitoring" in logging per IP address, you have to set it up all in detail and might require to do extra processing to have the general overview.
Other brands are indeed easier for this more general "monitoring" like per IP traffic rates and volumes, and web connections logging.
(Draytek, zeroShell, pfSense(?) ....) . Using Draytek today, looking for still better options. Not getting there with MT so far.

You can definitely do this on torch for real time, use the interface that the LAN gateway IP resides (usually bridge or master port), and untick everything except dst address (or src address depending on flow of traffic) and you can see the cumulative data used by each IP in instant real time.

You want to trend this, use netflow, which will also 100% tell you who is using how much over time.

If you are looking for a pretty page that shows the clients and current utilisation, you are looking for a consumer router. RouterOS is a versatile OS - it gives you access to as much information as you want, its up to you how you access it and what you do with it - people write tools on top to extract that data from RouterOS to make it more home friendly but that's their prerogative.

Is it really too hard fo Mikrotik guys to make ip address list and how much are those IP downloading/uploading? Or make graphs working for IP? Shame on them....

Its better you find an other router that does it for you...
MT is cheap and have a lot of function.

What is wrong about netflow?
Have you tried it?

Is it really too hard fo Mikrotik guys to make ip address list and how much are those IP downloading/uploading? Or make graphs working for IP? Shame on them....

Some of the ways you can monitor traffic:
https://wiki.mikrotik.com/wiki/Manual:IP/Accounting
https://wiki.mikrotik.com/wiki/Manual:IP/Traffic_Flow
https://wiki.mikrotik.com/wiki/Manual:I ... n_tracking
https://wiki.mikrotik.com/wiki/Manual:Queue
https://wiki.mikrotik.com/wiki/Manual:I ... all/Filter
And I am sure there are other features that I forget at the moment.

RouterOS is not some gaming ultra low latency super high speed rgb extreme plus - place your marketing wankword here - router.
You can do pretty much everything you want and much more, if you put in the effort. No wizards and nice looking graphs for you.
As others mentioned already, check Traffic Flow / NetFlow.

If you cannot be bothered to put in the effort, then RouterOS is not for you.

Do you mean Netflow by always exporting file and looking what happend in the past?

Am I asking to much to allow Tools/Graphs for IP adress? Why mikrotik never thought about it????? Why only ethers are allowed to see the graphs?? I dont know how they think....

Do you mean Netflow by always exporting file and looking what happend in the past?

Am I asking to much to allow Tools/Graphs for IP adress? Why mikrotik never thought about it????? Why only ethers are allowed to see the graphs?? I dont know how they think....

Because you are now asking them to build an entirely new product, a monitoring solution, with the information already available to YOU - how you access that information is up to you. Plenty of options provided on how to achieve what you want IN THE ROUTER (even with pretty graphs as you request) but you seem to be missing the point - RouterOS is a versatile OS, gives you access to all the knobs and buttons and information, lets you decide how you interact or view that information.

Am I asking to much to allow Tools/Graphs for IP adress?

Can you give an example on products doing this?
Monitoring one IP on the product are some what you do only in error situation. When you have a larger solution (example ISP) with many IP. You can not just follow one IP. You need a better/bigger solution like NetFlow.

Here is an example of using built in accounting function on the router with Splunk as graph engine.
This is download done on my PC last 24 hour with MB/5min as graph scale.

Setting up Splunk is some that any can do.
.

Splunk looks fine, but how much is the price? And why is instation so difficult? Could you make one script to install splunk? How much splunk will take from procesor capacity?

Well my download and install of the splunk/splunk:latest docker image went smooth and was very simple, just as the MikroTik APP install from @Jotne was very easy (well documented also)

Needs X86/X64 HW not ARM, so used my Synology NAS as host for Docker. There is a free license (as documented again).

Splunk is free, if you only need to logg less than 500MB/day.
For a small network that should be more than enough.