Knowledge Base

How to Discern Excessive Bandwidth Usage using PRTG Traffic Grapher

Diese Seite steht leider noch nicht auf Deutsch zur Verfügung. Wir bitten um Ihr Verständnis!
Beyond normal bandwidth monitoring capabilities based on SNMP, PRTG allows administrators to discern actual bandwidth usage based on multiple parameters,  such as IP addresses, port numbers, protocols, etc., using either packet sniffing or Netflow collector sensors. Packet sniffing sensors generally use the host machine's network card but can be configured to use monitoring ports found on some networking devices using port mirroring / forwarding in order to monitor the overall network bandwidth utilization. Netflow collectors receive data forwarded by Netflow-capable Cisco devices using Netflow collector licenses (available as PRTG add-ons). The configuration and implementation methods are outlined below.

Packet Sniffing Sensors



Using a device equipped with a "monitoring port" or "port mirroring" you can monitor all the traffic in your network. Most unmanaged switches do not have this feature, many managed switches do.

Port mirroring is used on a network switch to send a copy of all network packets seen on one switch port to a monitoring network connection on another switch port. This is commonly used for network appliances that require monitoring of network traffic, such as an intrusion-detection system. Port mirroring on a Cisco Systems switch is generally referred to as SPAN.

BTW: You can also use an old-fashioned hub. Hubs send all network packets to all ports but they are a lot slower than switches

  • Configure the switch(es) to send a copy of all network packets to the IP of the machine running PRTG
  • Create a new Packet Sniffer Sensor without any filtering to monitor network's total traffic

Note: If you have several switches/routers you may not see all traffic if you only monitor one device

Further information on setting up Packet Sniffer sensors can be found here.

Netflow Collector Sensors



Configure the NetFlow protocol on the router to send NetFlow packets to the computer running PRTG

  • (Purchase and) install Netflow Collector License (also works with trial license)
  • Configure a Netflow collector in PRTG
  • Create one new NetFlow sensor for each IP or protocol to be monitored and apply a filter based on the IP or protocol for each item you want to monitor
  • Or: If you do not need long term accounting data for each PC and only want to know the current and recent traffic by IP or protocol, you can  create just one NetFlow sensor and enable the Toplist feature based on IP or protocol.

Note: If you have several switches/routers you may not see all traffic if you only monitor one device

Further information on setting up Netflow sensors can be found here.

Configuring relevant Top Lists



Note 1: When working with Toplists be aware that privacy issues can come up for certain configurations of this feature. Using Toplists you can track all single connections of an individual PC to the outside world and you, as the administrator, must make sure that it is legal for you to configure PRTG like this.

Note 2: Keep in mind that Toplists are also shown in the web interface. You may not want to show lists of domains used in your network to others. In this case protect your PRTG webserver using passwords.

When you set up a new NetFlow or Packet Sniffer sensor three Toplists are created automatically:

  • Top Talkers
  • Top Connections
  • Top Protocols

This covers the most basic needs, but you can also edit the three toplists or create additional ones. Use the Add, Edit, and Delete buttons to manage your Toplists.

Further information on editing Toplists can be found here.

Configuring the system to use Top Lists in order to discern excessive usage based on IP address



  • Configure the device(s) in case to send a copy of all network packets to the IP of the machine running PRTG
  • Create one new Packet Sniffer / Netflow Collector sensor for each PC to be monitored and apply a filter based on the MAC address or IP of each PC you want to monitor
  • Or: If you do not need long term accounting data for each PC and only want to know the current and recent traffic by IP, you can create just one Packet Sniffer sensor and enable the Toplist feature based on IP.

Note: If you have several switches/routers you may not see all traffic if you only monitor one device

Once the relevant sensors are defined, you can recognize bandwidth usage either by comparing the individual sensor data or by monitoring the top list entries. Top lists also include a trend entry allowing to determine, at a glance, what machines / users are using more / less bandwidth than in prior scans. Furthermore, top lists will include listings of visited IP addresses (optionally, DNS resolution can be turned on in the top list settings), as such allowing to determine what machine / user accessed what server / web site.

Note: PRTG can not block access to any specific IP range, domain, DNS, or website!

Note: In order to monitor network traffic by IP address or protocol used by a shared Internet connection or leased line, please select filtering to exclude LAN IP addresses.

Click on the following links for further information on filters and protocols.

Further documentation



The following knowledgebase articles can further explain how to implement more customized monitoring solutions:

What does the "Other" channel mean in PRTG (including helpful information on how to define custom filtering paraemters)

Configuration tips for Cisco routers (including Netflow configuration information)

How RAM is allocated when using top lists

Comparing SNMP-based monitoring with packet sniffing and Netflow monitoring










By Category

PRTG Traffic Grapher V6

Related Articles