Usage Monitoring

Usage and Activity Monitoring

You can configure Top Lists in PRTG Network Monitor to find out what applications or what servers use up your bandwidth.

When you set up a new NetFlow or Packet Sniffing sensor in PRTG the following three Toplists are created automatically:

  • Top Talkers
  • Top Connections
  • Top Protocols


This covers the most basic needs, but you can also edit the three toplists or create additional ones. Further information on editing Toplists can be found here.

When working with Toplists be aware that privacy issues can come up for certain configurations of this feature since you monitor IP addresses of users. Using Toplists you can track all single connections of an individual PC to the outside world and you, as the administrator, must make sure that it is legal for you to configure PRTG like this.

Configuring the system to use Top Lists in order to discern excessive usage based on IP address

  • Configure the device(s) in case to send a copy of all network packets to the IP of the machine running PRTG
  • Create one new Packet Sniffer / Netflow Collector sensor for each PC to be monitored and apply a filter based on the MAC address or IP of each PC you want to monitor
  • Or: If you do not need long term accounting data for each PC and only want to know the current and recent traffic by IP, you can create just one Packet Sniffer sensor and enable the Toplist feature based on IP.

Note: If you have several switches/routers you may not see all traffic if you only monitor one device

Once the relevant sensors are defined, you can recognize bandwidth usage either by comparing the individual sensor data or by monitoring the top list entries. Top lists also include a trend entry allowing to determine, at a glance, what machines / users are using more / less bandwidth than in prior scans. Furthermore, top lists will include listings of visited IP addresses (optionally, DNS (Domain Name System, DNS servers resolve server names into the actual IP address of the server) resolution can be turned on in the top list settings), as such allowing to determine what machine / user accessed what server / web site.

Note: In order to monitor network traffic by IP address or protocol used by a shared Internet connection or leased line, please select filtering to exclude LAN IP addresses.

Click on the following links for further information on filters and protocols.