This article applies to PRTG Network Monitor 8.4.2.2320 or later

The Number of Possible Flows

The total number of flows that PRTG can process in an xFlow sensor is not easy to determine, since this depends on a lot of different factors. In contrast to traditional flow collectors PRTG does a real time processing of all incoming flows.

Different Factors

The number of flows PRTG can handle mainly depends on raw CPU power and memory, as well as the complexity and number of flow sensors used. Disk performance is not important.

Calculate Number of Flows

To get some numbers, we did tests on a current 3 GHz quad core system.

With a single NetFlow v5 sensor without any include or exclude rules the machine was able to handle about 150,000 flows per second.

If you are using multiple sensors you have to divide this number by the sensor count, since each sensor processes the flows individually.

PRTG uses a multithreaded architecture for flow processing. So, you can multiply the number of possible flows calculated for one single core by about half the number of your system’s CPU cores (for example, number * 2 for a quad core system).

Sample Calculation

With 100 flow sensors we got about 3,000 flows/second on our test machine: 150000 / 100 Sensors * ( 4 Cores / 2 ) = 3000

Important: All include/exclude/channel rules for all sensors are processed in real time. If you have very long or complex rules, the processing can be slowed down considerably (in the above 100 sensors example we used an include rule with 4 IP filters in every sensor).

How to Write Performant Filter Rules

Rules are processed from left to right and a short circuit evaluation is applied:

• In multiple OR evaluations, put the most likely conditions in the beginning
• In multiple AND evaluations, put the least likely conditions in the beginning
• Use brackets to give hints for fast evaluations

As a general rule, the CPU load on the probe system should not be above 80% to prevent packet loss. If you need more sensors than a single system can handle, please consider using a remote probe. You can then configure your router to send the flow stream to both probes (the local and the remote probe) and spread the flow sensors to the different probes.