This article applies as of PRTG 22

Comparison of SNMP-based monitoring with flow monitoring and Packet Sniffer-based monitoring

With SNMP, Packet Sniffer, and flow sensors, PRTG offers different means to monitor network traffic. The best solution for you depends on your network and on available resources.

SNMP

Simple Network Management Protocol (SNMP) is the basic means of gathering bandwidth and network usage data. Monitoring the bandwidth usage of routers and switches port by port is the most common use of SNMP, as well as monitoring device readings such as memory or CPU load.

• Recommended for most standard situations
• Does not support differentiation of traffic by service/protocol
• Causes the least CPU load

Packet Sniffer

Using the Packet Sniffer, PRTG inspects all network data packets that pass through the local system's network card. You can either only monitor the traffic on the PRTG core server system, or you make sure that all network traffic that you want to analyze passes it (for example by connecting it to the port of a switch that is used for monitoring activities).

• Recommended if differentiation of traffic by service/protocol is desired
• Creates the highest CPU load on the PRTG core server system
• In PRTG, you can view Toplists for data from this sensor type

Flows (IPFIX/NetFlow/sFlow/jFlow)

Flows can be used with most Cisco and many other routers to measure bandwidth usage. Although it is the most complex type, it is also the most powerful monitoring option for high-traffic networks.

• Recommended for high-traffic networks and for advanced users
• Requires changes in the router's setup: You must tell the router to send the flow packets to the PRTG core server system
• In PRTG, you can view Toplists for data from this sensor type

More

• Infographic: Comparison of SNMP, Packet Sniffing and NetFlow
• PRTG Manual: Bandwidth Monitoring Comparison
• How to differentiate between excessive bandwidth usage with PRTG?