Monitoring with Traffic Monitor, Torch, Graphs, SNMP and The Dude

What it is

Monitoring tools show how much traffic a network carries, who is sending it, and how it changes over time.

Some tools give a live view on one router, and the interface traffic monitor and Torch work this way.

Others collect data over time or from many devices. Graphs, SNMP and The Dude do that.

Choose the tool by the question: what is happening now, what happened earlier, or what is the state of the whole network.

How it works

Live tools read the router at this moment, and the collecting tools build a history.

Interface traffic monitor

The traffic monitor shows the current rate on an interface.

/interface monitor-traffic ether1

It prints the received and transmitted rates in bits and packets per second, and it updates every second. It tells you at once whether a link is busy, idle or maxed out.

You can monitor several interfaces in the same command by listing them. The command shows the rate only, and it does not tell you which host or service creates it.

Torch

Torch looks into the traffic of one interface and shows the flows that make it up.

/tool torch interface=ether1 src-address=0.0.0.0/0 dst-address=0.0.0.0/0

Each line shows a flow, with its protocol, ports and addresses, together with the rates in each direction. Torch answers the question that the traffic monitor cannot: who is using the bandwidth.

You can narrow the view with filters such as the protocol, the port or an address. For example, filter by one host to see only its flows.

Torch shows live data only, so it keeps no history. The measurements come from the router at the moment you run it.

Graphs

The graphing tool collects data over time and draws it as charts.

/tool graphing interface add interface=ether1
/tool graphing resource add

It can graph the traffic of interfaces and the use of resources such as CPU and memory. The charts are viewed in a browser through the web service of the router, so that service must be enabled. You can restrict which addresses may view them.

Graphs show daily, weekly and longer views. They help you spot trends, such as a link that grows busier each week, or a CPU that peaks at the same time every day.

SNMP

SNMP is a standard protocol that a management system uses to ask devices for their data. The router acts as an SNMP agent, and the manager polls it.

/snmp set enabled=yes contact=admin@example.com location=Office
/snmp community print

SNMP is turned on in its own menu. The community is a shared name that works like a password for the older versions. The default community is well known, so change it or restrict who may use it.

The manager reads values from the router, such as interface counters and CPU load. These values are identified by object identifiers that the manager knows from a description file, called a MIB. The manager can then draw graphs and raise alarms for many devices in one place.

SNMP is read only unless you allow writing. Keep it read only for monitoring.

The Dude

The Dude is a free network monitoring program from MikroTik. It finds devices in the network, draws a map and watches each device.

It can:

• discover devices automatically and draw a map of the network,
• probe services such as ping or ports, and show their state,
• draw charts of the values it collects, for example through SNMP,
• send notifications when a device or service changes state.

The Dude has a server part that collects the data, and a client part that you use to view it. A simple deployment runs both on the same computer.

Choosing a monitoring tool