When using Toplists in PRTG for Packet Sniffers or NetFlow Collectors you should be aware that it can take a considerable amount of memory. This article explains some details.

The memory usage for top lists of a sensor is composed of two parts:

• The "live" list for the current interval: It stores all entries encountered during the currently running interval and can become quite large.
• The historic lists contain the top x selected entries of recent toplists

The size of each list is calculated by mutiplying the size of one entry with the total number of entries. The size of one entry depends on the number and kind of fields selected by the user for the top list, plus 14 bytes of internal data.

So, an individual entry of a top connections list requires: 2*4 (for two IPs) + 2*2 (for two Ports) + 14 (internal data) = 26 Bytes

• The size of the live lists is difficult to estimate, but is usually much bigger than for historic lists. It depends on how many different entries (e.g. connections) are observed within a specific timeframe. This can be several thousands. The biggest factor here is the length of the interval and the complexity of the monitored traffic. If there are only 4 IPs talking to 8 other IPs you will not see a large list. But for a network with some hundred IPs surfing the web quite actively you can get really large data.
• In contrast to that a historic top 100 connections list requires only 100*26=2600 bytes. If you store 10 historic intervals then the total memory needed is 26 kbytes.

You can always investigate the size of the cache files in the "toplist" folder generated when exiting the application (use a representative time for the test and let it run a few intervals). This is a dump of all the toplist data in memory, so it is a good way to estimate the size of memory needed.

Please note that PRTG applies a memory overflow protection by limiting the memory available to toplists. This value can be set in the program options.