Sessions#

Observe → Sessions: the connections the router is tracking, by device. The page also keeps a traffic history for each device, and sets up flow export to a collector.

How current the table is#

The page refreshes every 3 seconds. The dot beside the filter reads live when the table is less than 10 seconds old. Otherwise it shows the table's age, such as 45s old, or stale when the page has had no answer for 8 seconds. The first reading after a long pause can be older: the agent answers with its last reading of the router's table while it reads the table again.

Connection accounting#

The router counts bytes and packets for each connection only when connection accounting is on. The router ships with it off, and it counts only connections opened after it is turned on.

When it is off, the panel Connection accounting is off reads "Connections are listed without their traffic: the router does not count bytes or packets per connection." If some connections still have counts from an earlier time it was on, it reads "New connections are not counted. The counts shown are for connections opened while it was on." instead.

Turning accounting on#

Press Turn on connection accounting, then Apply changes in the bar at the bottom of the page. Connections opened after that are counted; connections already open are not. It needs the operator role and a licence. The same setting is Connection accounting under Connection tracking settings on Diagnostics → Health.

When the router is counting but its settings do not keep counting on, as with a kernel tunable set for it, the panel is Connection accounting will turn off: "The router is counting traffic now, but its settings do not keep counting on: it stops at the next firewall or NAT change." Press Keep connection accounting on to add the setting that keeps it on.

When accounting is on and some connections were open before it was turned on, the page says how many, for example "2 of 6 connections were open before connection accounting was turned on and are not counted." Such a connection shows not counted in the Packets and Bytes columns, never 0.

In Advanced mode, the panel also shows the command and what the agent read.

The tiles#

Tile	Shows
Tracked connections	Connections in the table now.
Devices	How many addresses opened those connections.
Traffic counted	The bytes counted across the connections that have counts, with how many of the connections those are. None yet when accounting is on but every connection was open before it; Not counted when accounting is off.
Protocols	How many protocols, with the number of connections of each, such as "TCP 40 · UDP 22".

Top devices#

The 25 devices with the most traffic, or with the most connections when nothing is counted. The panel title says which: "by traffic" or "by connections".

Column	Shows
Device	The address that opened the connections.
Connections	How many connections it has open.
Counted	With accounting: all, or how many of its connections have counts, such as "1 of 3".
Packets, Bytes	With accounting: the totals of its counted connections.

All connections#

Column	Shows
Source	The address and port that opened the connection.
Destination	The address and port it goes to.
Protocol	TCP, UDP, ICMP and so on.
State	The connection's state, such as established or time wait.
Packets, Bytes	With accounting: the total, and under it what was sent and received.
Expires in	Seconds until the router forgets the connection if no more traffic arrives.

The Packets and Bytes columns appear in both tables only when at least one connection has counts. The filter at the top of the page matches any column of All connections. The tables list IPv4 connections.

In Advanced mode, a Tables and Raw switch shows the router's own table as text.

Traffic history by device#

The agent reads the router's connection table every 30 seconds and keeps a history for each device on the router. Choose the period with Day, Week or Month:

Period	What it shows
Day	Last 24 hours, by minute, for the day's busiest devices.
Week	Last 7 days, by hour.
Month	Last 31 days, by hour.

The eight busiest devices of the period are shown, by traffic, or by connections when nothing is counted. For each device:

a bar chart of the period: traffic per interval, or connections per interval when nothing is counted. An interval that was only partly recorded is drawn fainter;
"at least N connections · up to N peers at once";
the traffic, "at least" a total with what was sent and received under it, or not counted;
N offloaded, not counted, when some of its connections were offloaded: their traffic is not counted.

In Week and Month, by minute too marks a device that also has minute-by-minute history.

Minute-by-minute history is kept for the 16 busiest devices of the day, and hourly history for up to 256 devices. Devices on the router's own networks come first: an internet address, such as a client of a forwarded port, never takes a device's place, and a device takes the place of an internet address when every place is held. Internet addresses share what is left. Below the charts:

Row	Shows
Recording	How many devices are recorded, of up to 256, every 30 seconds.
Saved	The size of the saved history, and how often it is saved: every 5 minutes. If it cannot be saved, why.
Not recorded	Only when some devices are over the 256-device limit: their addresses, or how many there are.
Not measured	Only when there are more connections than one reading measures: how many were over the 32,768 measured at once.
Partial	Only when the connection table is longer than one reading covers: the totals cover part of it.

Two notes follow, from the agent:

"Totals are at least this much: connections are checked every 30 seconds, so a connection that opens and closes between two checks is not seen, and the traffic before a connection's first check and after its last is not counted."
"A device is listed for the connections it opened: a device on the network for the traffic it starts, and an internet host for the traffic it starts. Traffic is not broken down by application."

The history counts traffic only for connections opened while connection accounting was on; without it, the charts count connections. It is kept on the router and is not part of backups. In Advanced mode, How it is recorded gives the details.

A device appears after two readings, 30 seconds apart, have seen it; until then the panel reads Nothing recorded yet. When the agent does not run on the router, the panel says the history is not recorded, because it is read from the router's own connection table, and that flow export can send the same information to a collector.

Flow export#

The last panel sends NetFlow or IPFIX records of the router's traffic to a collector, which can keep a longer history. When it is off, the panel reads Flow export is off: "Send NetFlow or IPFIX records to a collector to keep traffic history off the router."

To set it up:

Press Set up flow export. The Set up flow export side panel opens.
Under Interfaces, tick the interfaces whose traffic is reported.
Under Collectors, press Add collector and enter its Address, and its Port if it is not 2055. Remove takes a collector out.
Under Records, choose the Format: NetFlow v9, IPFIX or NetFlow v5.
Enter a Sampling rate in packets to report one packet in that many. Leave it empty to count every packet.
Switch on Include outgoing traffic to report traffic leaving the interfaces as well. Off, only traffic arriving on them is reported.
Press Turn on flow export, then Apply changes in the bar at the bottom of the page.

The first problem with the form is shown at its foot, and the button stays disabled until it is fixed: "Choose at least one interface.", "Add a collector.", "Enter a port from 1 to 65535.", "Enter a whole number of packets." A collector's address must be an IP address, and a collector cannot be listed twice.

When flow export is on, the panel shows Interfaces, Collectors (each as address:port), Format, Sampling ("1 in N packets" or "Every packet") and Traffic ("Incoming and outgoing" or "Incoming"). Edit opens the side panel as Edit flow export, whose button is Save changes. Turn off asks Turn off flow export?; pressing it again adds the change, which removes all the flow export settings.

Setting up, changing and turning off flow export need the operator role and a licence. The guide is Export flows to a collector.

For automation#

Call	Returns
`GET /api/sessions`	The connections, the per-device totals, the accounting state, and `snapshotAgeMs`: how long before the answer the table was read. A connection that was not counted has `null` counters, never 0.
`GET /api/sessions/hosts?window=day`	The traffic history by device for `day`, `week` or `month`: eight devices unless `limit` asks for up to 32, or one with `host`. `available` is false, with a reason, when the history is not recorded.

Any role can read both. Connection accounting and flow export are changed through the pending changes, like any other setting.