Monitoring Bandwidth Usage Per User in MikroTik

Monitoring Bandwidth Usage on MikroTik

Knowing who is using your bandwidth and how much helps you plan capacity, spot anomalies, and enforce fair usage. MikroTik offers several built-in tools for bandwidth monitoring, from real-time sniffers to historical graphing.

Real-Time: The Torch Tool

The Torch is RouterOS's packet sniffer and traffic monitor. In Winbox: Tools → Torch. On CLI:

/tool torch interface=ether1 ip-protocol=any

This shows live traffic per IP/protocol with source and destination, making it easy to see exactly what a specific IP is doing right now.

Per-Interface Traffic with Graphing

Enable the built-in traffic graphs for any interface:

/tool graphing interface add interface=ether1 store-on-disk=yes

Then browse to http://routerip/graphs/ (or use Winbox → Tools → Graphing) to see historical in/out traffic charts.

Accounting: Track Per-IP Bandwidth Usage

RouterOS has a built-in IP accounting feature that tracks how much data each IP address sent and received:

/ip accounting set enabled=yes account-local-traffic=no threshold=256

View current stats:

/ip accounting snapshot take
/ip accounting print

This shows per-IP byte counts since the last reset. Reset with:

/ip accounting clear

Queue Statistics for Per-User Tracking

If you have per-IP Simple Queues, each queue's stats give you per-user consumption:

/queue simple print stats

SNMP + LibreNMS/Zabbix for Historical Trending

The most powerful approach for long-term capacity planning:

1. Enable SNMP as covered in the SNMP post
2. Add the router to LibreNMS or Zabbix
3. The platform polls interface counters every 5 minutes and stores them in a database
4. You get traffic graphs, 95th percentile calculations, and trend reports

Bandwidth Usage by Protocol

Use Mangle to mark traffic by type, then see queue or accounting stats per mark:

/ip firewall mangle add chain=forward protocol=tcp dst-port=80,443 action=mark-packet new-packet-mark=http-traffic passthrough=yes
/ip firewall mangle add chain=forward protocol=udp dst-port=53 action=mark-packet new-packet-mark=dns-traffic passthrough=yes

Then in queue stats, you see separate counters for HTTP vs DNS vs everything else.

Setting Up Usage Alerts

Use Netwatch or a Scheduler script to check a threshold and send an alert:

/system script add name=check-bandwidth source={
  :local bps [/interface get ether1 rx-byte]
  :if ($bps > 900000000) do={
    /tool e-mail send to=admin@example.com subject="WAN Near Saturation" body="ether1 rx high"
  }
}
/system scheduler add name=bw-check interval=5m on-event=check-bandwidth

Bandwidth visibility is the first step in capacity management. Without data, you're guessing — with data, you can make informed decisions about upgrading links, enforcing QoS, or investigating anomalies.