Hi,
how do I find out how much data was transferred over an interface over a certain period of time, like how much was transferred over a WAN interface within a month?
It seems it would be a simple, basic feature of a router/firewall to be showing that information, but somehow I can't find it.
Install the os-vnstat plugin.
You could also go to "Reporting -> Insight" and enable netflow only for the WAN interface, then you can also get statistics like these.
Not terribly convenient, but: "Firewall: Diagnostics: Statistics" -> "interfaces" -> [interface]. Those are pf stats, I believe. Outside of pf: "Interfaces: Diagnostics: Netstat" -> "Interfaces" -> "statistics" -> [interface].
Edit: No selectable interval, just since last clear (generally boot).
None of those would show any data for the last month, for example ...
I don't want to capture all the data like netflow seems to do --- and why would I need to limit it to the WAN interface(s)? Is there no way to get decent reports from all the gathered data?
Imagine I want to be able to just look at the dashboard and see that information, plain and simple, without any further ado except maybe adding a widget for it. It should be just there.
The data simply is not gathered/logged in any meaningful way outside of management systems like Netflow or SNMP.
Quote from: pfry on September 03, 2026, 04:40:31 PMNot terribly convenient, but: "Firewall: Diagnostics: Statistics" -> "interfaces" -> [interface]. Those are pf stats, I believe. Outside of pf: "Interfaces: Diagnostics: Netstat" -> "Interfaces" -> "statistics" -> [interface].
Edit: No selectable interval, just since last clear (generally boot).
Hm that helps :) At least it says clearly when the last reset was, which is important for PPPoE interfaces. I'd also like to see how many times a PPPoE interface was resetted during a give time, like a month, but strangely, that information is also unavailable.
Quote from: Patrick M. Hausen on September 03, 2026, 04:48:21 PMThe data simply is not gathered/logged in any meaningful way outside of management systems like Netflow or SNMP.
Maybe that needs to change so we can at least easily see how much data was going over the WAN interface(s). Is that so difficult?
When I look at the statistics and it says 'cleared: 1970-01-01T01:00:02', what does that mean?
Quote from: defaultuserfoo on September 03, 2026, 04:47:05 PMNone of those would show any data for the last month, for example ...
I don't want to capture all the data like netflow seems to do --- and why would I need to limit it to the WAN interface(s)? Is there no way to get decent reports from all the gathered data?
Imagine I want to be able to just look at the dashboard and see that information, plain and simple, without any further ado except maybe adding a widget for it. It should be just there.
vnstat shows that. and recent releases also contain a vnstat widget for the dashboard: https://forum.opnsense.org/index.php?topic=51328.0
Quote from: dirtyfreebooter on September 03, 2026, 05:15:44 PMQuote from: defaultuserfoo on September 03, 2026, 04:47:05 PMNone of those would show any data for the last month, for example ...
I don't want to capture all the data like netflow seems to do --- and why would I need to limit it to the WAN interface(s)? Is there no way to get decent reports from all the gathered data?
Imagine I want to be able to just look at the dashboard and see that information, plain and simple, without any further ado except maybe adding a widget for it. It should be just there.
vnstat shows that. and recent releases also contain a vnstat widget for the dashboard: https://forum.opnsense.org/index.php?topic=51328.0
Cool, I'll try it out :)
ATM, I'm wondering why the counters of the parent interface of one of the VLAN interfaces which is a WAN interface are so high while the counters of the VLAN interface itself only show some IPv4 blocked packages and all other counters are 0. When I look at other VLAN interfaces, thier counters look ok.
Quote from: defaultuserfoo on September 03, 2026, 05:03:05 PMWhen I look at the statistics and it says 'cleared: 1970-01-01T01:00:02', what does that mean?
It means it was cleared before time synchronization took place. 1970-01-01 is the beginning of Unix time (https://en.wikipedia.org/wiki/Unix_time).
Quote from: defaultuserfoo on September 03, 2026, 04:57:40 PMMaybe that needs to change so we can at least easily see how much data was going over the WAN interface(s). Is that so difficult?
The operating system does count the bytes and packets that go over each interface. The counters are cleared at every reboot. But for any retention to take place and a meaningful historical display you need some additional tool like a network management system. I like SNMP based ones because they place very little load on the managed firewall and can also be applied to all sorts of switches, access points, NAS, ... etc.
The attached screen shot shows one week of traffic on my WAN interface in Observium.
Quote from: bamf on September 03, 2026, 05:22:24 PMQuote from: defaultuserfoo on September 03, 2026, 05:03:05 PMWhen I look at the statistics and it says 'cleared: 1970-01-01T01:00:02', what does that mean?
It means it was cleared before time synchronization took place. 1970-01-01 is the beginning of Unix time (https://en.wikipedia.org/wiki/Unix_time).
That's kinda what I thought.
So how do I find out how many times a PPPoE connection was reset during a given period of time?