I’m wondering if Graylog can provide a way to track traffic/data usage per LAN IP for my home network. I’ve been trying to get this visualized using splunk and netflow, but this is way overkill for my purpose. Let me sketch the setup;
We have an internet modem X, which is bridged to a router Y, the y has several switches and wifi APs connected to its 10 ports. Router Y does some firewalling, but not much, since the internet modem is already connected to the world through CGNAT. Local DNS and DHCP are done using pi-hole and unbound from a separate proxmox instance in the LAN.
The router Y can send out SNMP/syslog messages, pretty much all the detail I would want it to send out can be configured as I would wish (mikrotik). So also the traffic per IP to/fro the modem, I would think.
The issue is that most logging visualisation tools I’ve tried (librenms, zabbix, nagios, splunk, logstail and many others) end up showing interface data/traffic, not
source WAN to destination LAN-IP. Usually it’s part of some ‘billing’ or ‘accounting’ unit, but I just want to find out which device uses how much GB per selected time-span. Most tools show the total on the WAN IO interface per time-span, not the total I+O to/from WAN per LAN IP.
So, I’m wondering, before I dive into graylog, is this somehow easy to accomplish for my setup? I run several debian based options to install graylog on within the LAN.