PRTG Manual: Toplists
Packet Sniffer sensors and Flow (NetFlow, jFlow, sFlow, IPFIX) sensors not only measure the total bandwidth usage, but also break down traffic by IP address, port, protocol, and other parameters. This way, PRTG can tell which IP address, connection, or protocol uses the most bandwidth. PRTG shows the results in Toplists.
Toplist Top Protocols for a Packet Sniffer Sensor
PRTG looks at all network packets and collects the bandwidth information for all IP addresses, ports, and protocols. This creates a huge amount of analysis data. To reduce the amount of data that is actually stored, PRTG only stores the top 100 entries of each Toplist in the database at the end of a specified Toplist period by default.
Toplists are only available for Flow and Packet Sniffer sensors. PRTG displays Toplist on the sensor's Overview tab.
For more information about the Overview tab, see the Knowledge Base: What options do I have to review my monitoring data in detail?
Toplist Overview for a Packet Sniffer Sensor
By default, there are three preconfigured Toplists:
Toplist |
Description |
|---|---|
Top Talkers |
Shows bandwidth usage by IP address. |
Top Connections |
Shows bandwidth usage by connection. |
Top Protocols |
Shows bandwidth usage by protocol. |
- Click one of the Toplist names on the sensor's Overview tab or click
below a Toplist to view a distribution chart and a list of source IP addresses and destination IP addresses, source ports and destination ports, protocols, or kinds of traffic in different channels, for example. What kind of information is available depends on the selected Toplist.
- Click an entry in the Toplist periods list on the left side to view data for a specific time period. The default value is 15 minutes. You can also manually define the start and end time of the Toplist period that you want to view. Use the date time picker to enter the date and time. Additionally, several table list options are available.
- Click Print This Toplist to view a printer-friendly version of your Toplist and use the print dialog of your browser to print the Toplist.
- Click Sensor Overview to return to the selected sensor's Overview tab. For a quick selection of other Toplists of the selected sensor, click one of the Toplist tiles at the top of the page.
Toplist Tiles
- Click Add Toplist on the sensor's Overview tab to create a new Toplist. The available options are the same as when you edit a Toplist.
- Click
below a Toplist on the sensor's Overview tab and confirm with Delete to delete the Toplist.
Click 
below a Toplist on the sensor's Overview tab to modify a Toplist.
Setting |
Description |
|---|---|
Name |
Enter a name to identify the Toplist.
|
Toplist Type |
Select the type of Toplist:
|
Toplist Fields |
This setting is only visible if you select Custom above. Select the fields that you want to add to the Toplist by enabling the check box in front of the respective field name. The available options depend on the sensor. They are different for Packet Sniffer, NetFlow v5, NetFlow v9, IPFIX, and sFlow sensors.
|
Toplist Period (Minutes) |
Define the time span that a Toplist period covers in minutes. Enter an integer. When a Toplist period is finished, PRTG stores the top results and starts a new Toplist period.
|
Top Count |
Define the length of your Toplist. PRTG stores only this number of entries for each Toplist period. Enter an integer.
|
Reverse DNS Lookup |
Define if you want to do a reverse Domain Name System (DNS) lookup for IP addresses that are stored in the Toplist:
|
Data Transfer |
Define how the probe sends the Toplist data set to the PRTG core server:
|
Memory Limit (MB) |
Define the maximum amount of memory (in megabytes) that the probe uses to collect the different connection information. Every Toplist adds its amount of used memory to the probe's memory consumption. Increase this value if the number of captured connections is not sufficient. Enter an integer. |
Save your settings. If you change tabs or use the main menu without saving, all changes to the settings are lost.
If you create Toplists for data lines with considerable usage (for example, steady bandwidth over 10 megabits per second) or if the traffic is very diverse (for example, many IP addresses or ports with only little traffic each), consider the following aspects:
- The probe gathers all information that is needed for the Toplist in RAM during each Toplist period. By default, only the top 100 entries are transferred to the PRTG core server. Depending on the Toplist type and the traffic patterns, the required memory can consume many megabytes.
- Define Toplist periods that are as short as possible to minimize memory usage. This is especially important when the traffic is highly diverse.
- Memory requirements can grow almost exponentially with each Toplist field that you use in the Toplist definition (depending on the traffic pattern). Avoid complex Toplists for high and diverse traffic. For example, the Toplist Top Connections with 5 Toplist fields needs a lot more memory than the Toplist Top Talkers with 1 Toplist field.
- If you notice a high bandwidth usage between the PRTG core server and the probe, try the At end of Toplist period option in the Toplist settings.
- If you get Data incomplete, memory limit was exceeded messages, try to increase the memory limit in the Toplist settings but keep an eye on the memory usage of the probe process.
- To increase the performance of a Toplist, disable the reverse DNS lookup setting.
- When you work with Toplists, be aware that privacy issues can come up for certain configurations of this feature. Using Toplists, you can track all single connections of an individual system to the outside world and you must make sure that it is legal for you to configure PRTG like this.
- Keep in mind that Toplists can be viewed in the PRTG web interface. You might not want to show lists of domains that are used in your network to others, so restrict access rights to sensors that have Toplists.
- Toplist charts, for example for top connections, are not meant to be used for detailed analysis. Instead, they should indicate if there is an uncommon, bigger change in this Toplist.
KNOWLEDGE BASE
What security features does PRTG include?
What options do I have to review my monitoring data in detail?
