PRTG Manual: Monitoring Bandwidth via Flows

Using Flow (NetFlow, jFlow, sFlow, IPFIX) protocols, you can monitor the bandwidth usage of all packets going through a device. In PRTG, you can view Toplists for all xFlow sensors.

xFlows are monitoring data pushed from network devices to PRTG. You can use them to monitor where and how much data is traveling to and from. This way, they determine which machine, protocol, or user is consuming bandwidth. PRTG supports the following xFlow types:

NetFlow v5/v9 and IPFIX: Originally introduced by Cisco and supported by several vendors.
jFlow: Traffic sampling technology introduced by Juniper networks.
sFlow: Short for sampled flow, introduced by HP. sFlow uses statistical sampling of the traffic at defined intervals to achieve scalability for high volume interfaces.

You can also use packet sniffing for bandwidth monitoring if your hardware does not support any of these xFlow versions.

How Flow Monitoring works

You can measure bandwidth usage by IP address or by application in a network, using one of the flow protocols. They are the best choice especially for networks with high traffic (connections with hundreds of megabits or gigabits).

For flow monitoring, the router gathers bandwidth usage data (flows), aggregates it, and sends information about it to PRTG using User Datagram Protocol (UDP) packets. When you use sampling (mandatory for sFlow), only information about every n-th packet is sent to PRTG, which reduces CPU load a lot. Because the switch already performs an aggregation of traffic data beforehand, the flow of data to PRTG is much smaller than the monitored traffic. This makes flow the ideal option for high traffic networks that need to differentiate the bandwidth usage by network protocol and/or IP addresses.

NetFlow and IPFIX Monitoring

The NetFlow (and IPFIX) protocol is mainly used by Cisco devices. Once configured, the router sends a NetFlow or IPFIX packet for each data flow to the monitoring system running on a probe. You can filter and evaluate the data in PRTG. Different NetFlow and IPFIX sensors are available: The basic sensors offer predefined channel definitions, the custom variants enable you to define your own channels.

The advantage of using NetFlow or IPFIX:

Generates little CPU load on the router itself (according to Cisco, 10,000 active flows create about 7% additional CPU load; 45,000 active flows account for about 20% additional CPU load).
Generates less CPU load on the PRTG core server system compared to Packet Sniffer sensors.

You must enable NetFlow or IPFIX export on the target device. The device must send a flow data stream to the IP address of the probe system on which you set up the NetFlow or IPFIX sensor.

You can monitor Juniper jFlow with the corresponding sensors as well. Basically they are adjusted NetFlow v5 sensors.

NetFlow Lite monitoring is possible using the Sampling Mode of the NetFlow v9 sensor or of the NetFlow v9 (Custom) sensor. You can turn on the sampling mode and define a suitable Sampling Rate in the sensor settings. Note that NetFlow Lite monitoring might not work in every case even with active sampling mode.

sFlow Monitoring

sFlow works similar to NetFlow monitoring. The router sends data flow packets to the monitoring system running on a probe. The most obvious difference between the two flow protocols: With sFlow, not all of the traffic is analyzed, but only every n-th packet.

The advantage is clear: There is less data to analyze, there is less CPU load needed, and less monitoring traffic is generated. Nevertheless, you can get a good insight into your network bandwidth usage.

PRTG supports sFlow v5.

Set Up Flow Sensors

Find details on how to set up the different flow sensors in the following sections:

Limitations

For example, with a dual core, 2.5 Ghz hardware system, you can process about 100,000 flows per second for one flow stream. Using sampling, the number of actual flows can be much higher. When using complex filters, the value can be much lower. For example, with a router sending about 2,000 flows/second (which corresponds to mixed traffic at gigabit/second level without sampling) you can expect to configure up to 50 flow sensors operating properly.

PRTG internally monitors its own flow processing. You can see decreased values in the Health channels of the Core Health and Probe Health sensors as soon as flow packets are not processed because of an overload (you find these sensors on the local probe device).

If you experience an overload, consider using sampling or setting up multiple probes and distributing the flow streams to them. We recommend that you do not add more than 50 flow sensors per probe.

IPv6 flows are supported by NetFlow v9 sensors and IPFIX sensors, other flow sensors only support IPv4.

KNOWLEDGE BASE