This article applies to PRTG Network Monitor 12 or later

Comparing PRTG's SNMP Based Monitoring with Flow Monitoring and Packet Sniffer Based Monitoring

With SNMP, Packet Sniffer, and Flow sensors, PRTG offers different means to monitoring network traffic. The best solution for you depends on your network and on available resources.

SNMP

SNMP (Simple Network Management Protocol) is the basic means of gathering bandwidth and network usage data. Monitoring the bandwidth usage of routers and switches port-by-port is the most common use of SNMP as well as monitoring device readings such as memory, CPU load etc.

• Recommended for most standard situations
• Does not support differentiation of traffic by service/protocol
• Causes the least CPU load

Packet Sniffer

Using the Packet Sniffer, PRTG can inspect all network data packets passing through the local machine's network card. You can either only monitor the traffic on the machine that runs PRTG or you must make sure that all network traffic you want to analyze passes it (e.g. by connecting it to the "monitoring" port of a switch).

• Recommended if differentiation of traffic by service/protocol is desired
• Creates the highest CPU load on the machine running PRTG
• In PRTG, you can view "Toplists" for data of this sensor type

xFlow (IPFIX/NetFlow/sFlow/jFlow)

Flows can be used with most Cisco and many other routers to measure bandwidth usage. Although it is the most complex type, it is also the most powerful monitoring option for high traffic networks.

• Recommended for high traffic networks and for advanced users
• Requires changes in the router's setup (you must tell the router to send to the Flow packets to the machine running PRTG!)
• In PRTG, you can view "Toplists" for data from this sensor type

See Also

• Infographic: Comparison of SNMP, Packet Sniffing and NetFlow
• PRTG Manual: Comparison of Bandwidth Monitoring Sensors
• How do I discern excessive bandwidth usage with PRTG?