Counting Wifi Using Router Logs

You’ve covered your library in a gentle, soothing blanket of Wifi, your patrons love it, and you want to make sure that you can accurately report data on usage to your library board and on the public library annual report. So…what’s next?

There are several different methods you can use to track Wifi usage in your library, and it will depend entirely on your networking hardware and configuration. While there is no one-size-fits-all solution to the problem, there is one solution that is nearly universal: router logs.

Wifi routers – from inexpensive consumer solutions to large scale enterprise devices – log a variety of data about who is connecting to the device. You can use those logs to track who is connecting to your Wifi network on a daily, weekly, or even monthly basis, depending on the logging capabilities of your router.

Let’s take a look at a common consumer-grade router and see how easy (or hard) it is to get the data we need. For this example, we’ll use the Netgear n750.

Step 1: Setup Email Notifications

The admin interface of our router offers a nifty feature whereby we can configure the router to email the log on a daily, weekly, etc. basis.

  1. The first thing we need to do is check the box next to Turn E-mail Notification On.
  2. After that we need to provide info about the email account that we want to use to receive notifications. The path of least resistance is, as if often is: Google.
    1. Your Outgoing Mail Server: set this to use Google’s outgoing email server at aspmx.l.google.com
    2. Send to This E-mail Address: set this to your email address, e.g. lrs@lrs.org.
    3. Under Send logs according to this schedule, specify how frequently you want to be emailed.

That’s it, you’re done! Well, you’re probably done. If you fail to receive emails from the router you might need to configure your Gmail account to allow access from less secure apps. No problem, simply follow the instructions at https://support.google.com/accounts/answer/6010255?hl=en.

You can test the email function by going to the log page in the router interface and clicking Send Log.

Step 2: Analyze Your Log

You’ve setup your router to email logs, they are rolling into your Gmail on a regular basis, and now you have no idea what to do with them! Don’t worry, LRS has you covered. There are couple of ways you can tally up usage based on the data within the logs.

Before we dive in, let’s look at what a typical log contains.

[DoS Attack: SYN/ACK Scan] from source: 138.128.140.203, port 80, Tuesday, March 05, 2019 13:42:36
[DHCP IP: 192.168.1.18] to MAC address 00:xx:xx:xx:xx:xx, Tuesday, March 05, 2019 13:39:49
[DHCP IP: 192.168.1.11] to MAC address d8:xx:xx:xx:xx:xx, Tuesday, March 05, 2019 12:49:14
[DHCP IP: 192.168.1.20] to MAC address 00:xx:xx:xx:xx:xx, Tuesday, March 05, 2019 12:49:07
[DHCP IP: 192.168.1.11] to MAC address d8:xx:xx:xx:xx:xx, Tuesday, March 05, 2019 12:46:09
[DHCP IP: 192.168.1.13] to MAC address 38:xx:xx:xx:xx:xx, Tuesday, March 05, 2019 12:45:27

Yikes…that doesn’t look familiar to most of us. Our router logs when people connect to it (DHCP IP: ….) and it also logs what it thinks are security issues (DoS Attack). If we let the log grow large enough we’ll probably see other types of messages in it.

We are only concerned with counting the number of times that people connect, and that means counting each time we see [DHCP IP: 192.168.1.xx] to MAC address xx:xx:xx:xx:xx:xx appear in the log. Note: your network’s IP address might be slightly different (e.g. 192.168.0.xx), and the MAC address will be different for every device that connects.

The Hard Way

Use a program like Notepad++ to delete every line that doesn’t match our connections, then count up the number of lines that remain. Using our example above, we’d end up with something like this:

1. [DHCP IP: 192.168.1.18] to MAC address 00:xx:xx:xx:xx:xx, Tuesday, March 05, 2019 13:39:49
2. [DHCP IP: 192.168.1.11] to MAC address d8:xx:xx:xx:xx:xx, Tuesday, March 05, 2019 12:49:14
3. [DHCP IP: 192.168.1.20] to MAC address 00:xx:xx:xx:xx:xx, Tuesday, March 05, 2019 12:49:07
4. [DHCP IP: 192.168.1.11] to MAC address d8:xx:xx:xx:xx:xx, Tuesday, March 05, 2019 12:46:09
5. [DHCP IP: 192.168.1.13] to MAC address 38:xx:xx:xx:xx:xx, Tuesday, March 05, 2019 12:45:27

Keep in mind that since your router probably won’t log a year’s worth of data, and since you wouldn’t want to try and parse that amount of log anyway, you’ll be taking a sample once a week, or several times a month. That means you’ll need to also group your totals by each day within the log.

The Easy Way

Use a script to do the heavy lifting for you. If your router uses a sensible format to log connections (as our Netgear does), then it is trivial to use a scripting language/program to do the counting for you. Once again, LRS has your back. We have developed a tool that ingests router logs and spits out daily totals.

You can find the tool at https://www.lrs.org/interactive/parse-router-log/.

Now the process is simple.

  1. Go to https://www.lrs.org/interactive/parse-router-log/.
  2. Select the brand/model of your router.
    1. If your router is not present, contact LRS and we will modify the tool to parse your logs. You will need to send us a sample from your log.
  3. Paste the contents of your log into the box labeled Paste your log.
  4. Click Parse.

Here’s what the page looks like using our sample log data from above.

After that you can kick back, crack open your favorite cold beverage, and decide whether you tell your boss just how easy the process was, or maybe let them think you heroically sweated and toiled over the process.