Find what is using the link right now#

You will end up knowing which device is behind the traffic on the link now, and what it is connected to. The page is documented on Sessions.

Before you start#

Any role. Reading needs no licence.
Connection accounting, for traffic figures. Without it, devices are ranked by their number of connections. It counts only connections opened after it is turned on.

Step 1 — Open Sessions#

Open Observe → Sessions. The Connected now card on the Overview draws the busiest devices on the LAN, sized by their connections, and Chart → at its top right opens this page too.

The page refreshes every 3 seconds. The dot beside the filter reads live, or says how old the table is.

Step 2 — Find the device#

Top devices lists the 25 devices with the most traffic, or with the most connections when nothing is counted. Device is the address that opened the connections.

If the Connection accounting is off panel is shown, press Turn on connection accounting and apply the change. Connections opened after that are counted.

Step 3 — See what it is doing#

Type the device's address in the filter at the top of the page. All connections then lists its connections: Destination, Protocol and State, and with accounting Packets and Bytes, each split into sent and received. The filter matches any column, so a port or a protocol works too.

Step 4 — Confirm it is the link#

The Traffic card on the Overview charts the uplink: WAN in as the cyan area and WAN out as the orange line, over 1h, 6h or 24h, with the peak of the range. A link that is full shows a flat line at its capacity. For any other interface, use the History view on Interfaces.

If the link is full, shaping keeps one device's traffic from delaying everyone else's: Shape a link with CAKE.

Earlier today, or last week#

Traffic history by device, further down the Sessions page, keeps each device's connections and, with connection accounting on, its traffic: Day by minute for the day's busiest devices, Week and Month by hour. It shows the eight busiest devices of the period. Totals are at least what was seen: connections are checked every 30 seconds.

For per-connection records, or history longer than 31 days, export flows to a collector: Export flows to a collector.

When the connection table is the problem#

When the router's connection table is full, new connections fail while existing ones keep working. Diagnostics → Health says whether that is happening, and its Connection tracking settings panel sets the table size. Top devices, sorted by Connections, shows whether one device holds an unusual number of connections.

Check it worked#

You have the answer when you can name the device and what it is connected to. Then:

Block it with a firewall rule — A default-drop ruleset.
Shape it, so that it does not slow everything else — Shape a link with CAKE.
Or look at the device itself.