Hello,
i need filter or script to show users who surfing google only or facebook oly or all other only in addresss-list and with Period


for example :
pppoe-1 using only google ips ..... can be shown in address-ist under named google-only Period from 1PM - 12AM
pppoe-2 using only facebook ips ... can be shown in address-ist under named facebook-only 1PM - 12AM
pppoe-3 using all other ipes only ( Not using facebook or google ) can be shown in address-ist under named international-only 1PM - 12AM

I don't assume that many here are willing to help you with this. Spying on your users is not nice to be doing.

no sir i am not but there is a load balances users that affect to the others and we do not accept that way of the work so we need detect the operation and stop it

Do you mean you have load balancing setup on the router and its not working?

NO SIR
i am an isp and there is some home users doing load balance and consume us extra bandwidth i need to stop it by that way

Load balancing among what? Several links? If they aggregate the bandwidth of several links, they have to pay for several links, so where is the problem? Or do they run several pppoe sessions on the same physical connection to get more bandwidth without paying for it?

Describe the actual situation in detail to get an appropriate recommendation.

they buy 5 pppoe and doing loadbalance and run it for 30 pppoe home user after doing loadbalance in Mikrotik

Ah, so you mean they pay for 5 normal home connections, but you have overbooked your uplink, assuming that a normal home user actually doesn't use all the bandwidth you've sold him all the time?

So thanks to connecting multiple homes to the connections you provide them, those "resellers" really use all the bandwidth most of the time, and thus your overbooking calculation doesn't work?

If so, I hesitate to judge who is the bad guy in this story...

On the other hand, if you've fairly stated in the contract that the full bandwidth can only be used during some percentage of the time, you're fully in charge of throttling connections which break that.

Not Like That you are far a way

===> they buy 2 pppoe and sell it to 10 home user by doing loadbalance in mikrotik NTH or PCC

I still don't get the point.

There is no way to distinguish between a "honest" and "fake" user by statistics of google/facebook/whatever access, because you never get access to any individual user identifiers. And by traffic volume, you can never distinguish between a "honest" home user with many children and devices and a "fake" user who tethers the connection to others.

And again, whereas I understand that the "fake" users make easy money and lower your own profit by reselling your service and stealing your potential direct customers because they sell a slightly worse service for interestingly less money, there's nothing at technical side you could do to reliably identify the accounts used this way.

@qudama, I have sent you a private message, check your mailbox.

thanks all guys..