PRTG Manual: Monitoring Bandwidth via Packet Sniffing
Packet Sniffing should come into consideration if your network device(s) do not support SNMP or xFlow to measure bandwidth usage and if you need to differentiate the bandwidth usage by network protocol and/or IP addresses.
Note: Packet Sniffer Sensors support Toplists (Top Talkers, Top Connections, etc.), see Toplists section.
If you need to know what applications or IP addresses are causing the traffic in your network, you can use a packet sniffer. This will look at every single data packet traveling through your network for accounting purposes.
Monitoring with PRTG via Packet Sniffer Sensors
PRTG can analyze the packets passing the network card of a PC or it can be connected to the so-called monitoring port of a switch. In order to calculate bandwidth usage, PRTG inspects all network data packets either passing the PC's network card (shown on the left side) or the data packets sent by a monitoring port of a switch (right side) with its built-in packet sniffer. Using remote probes you can set up packet sniffers anywhere in your network (see Add Remote Probe section).
Comparing the four bandwidth monitoring technologies provided by PRTG (SNMP, WMI, xFlow and packet sniffer) this one creates the most CPU and network load and should thus only be used in small to medium networks, on dedicated computers for larger networks or for individual computers.
Reasons To Choose Packet Sniffing
It is important to understand that the packet sniffer can only access and inspect data packets that actually flow through the network interface(s) of the machine running the PRTG probe software. This is fine if you only want to monitor the traffic of this machine (e.g. your web server). In switched networks, only the traffic for a specific machine is sent to each machine's network card, so PRTG can usually not discern the traffic of the other machines in the network.
If you also want to monitor the traffic of other devices in your network, you must use a switch that offers a "monitoring port" or "port mirroring" configuration (Cisco calls it "SPAN"). In this case the switch sends a copy to the monitoring port of all data packets traveling through the switch. As soon as you connect one of the PRTG probe system's network cards to the switch's monitoring port, PRTG is able to analyze the complete traffic that passes through the switch.
Another option is to set up the PC running PRTG as the gateway for all other computers in the network.
Find details on how to set up the different flow sensors in the following sections:
For packet sniffing, PRTG looks at the IPs and ports of source and destination to assess the protocol. This is a very fast method which saves system resources. Note: At times, this method is not fully accurate. For example it is not possible to identify HTTP traffic on ports other than 80, 8080 and 443 as HTTP. HTTP traffic on non-standard ports would not be accounted as such.
Tool: Paessler Card Packet Counter: Shows short term statistics about the network data packets passing a local network card.
Keywords: Packet Sniffing,Packet Sniffing Technology