Powerful NetFlow Traffic Analyzer

Know what's using your bandwidth, which devices are responsible, and where your network is headed.

What Does a NetFlow Traffic Analyzer Actually Show You?

Network traffic analysis gives you the breakdown your interface graphs can't: which IPs are talking, what protocols and applications are driving the traffic, and how bandwidth usage has changed over time. Paessler PRTG works as both collector and network traffic analyzer in one. Devices export flow records directly to PRTG, and the data shows up as structured, filterable visibility across your network.

You see network flow by IP address, by connection pair, by protocol, and by application category. That's enough to go from "something is saturating this link" to a specific answer, and to act on it.

Supported flow protocols and vendors: NetFlow v5, NetFlow v9, IPFIX, jFlow v5, sFlow. Supported vendors include Cisco, Juniper, HP/Aruba, Fortinet, and other major hardware manufacturers.

Download PRTG Trial

PRTG is compatible with all major vendors, products, and systems

NetFlow Traffic Analysis That Answers the Right Questions

See Exactly Who and What Is Saturating Your Network

Getting to the root of a bandwidth issue means having per-IP and per-protocol visibility, not just interface totals. PRTG's Toplist view breaks down all incoming flow data into three categories: Top Talkers by IP address, Top Connections by source-destination pair, and Top Protocols. Together, these show you exactly what's running on the link. Every xFlow sensor gets this breakdown out of the box. As flow records arrive from your routers and switches, the data updates without you digging through logs or running manual queries.

Top Talkers ranked by IP address and bandwidth consumed
Top Connections showing source-destination pairs
Top Protocols identifying traffic flow across the interface
Near-real-time data as flow records arrive from routers and switches
No log digging to drill down into bandwidth hogs and bottlenecks

Know Which Applications Are Driving Your Traffic

Application-level context is what turns an IP address into a useful data point. Knowing whether a device is running an RDP session, pulling a large backup, or uploading over FTP changes the call you make. PRTG's flow sensors include predefined channel filters that categorize traffic by application type based on port and protocol, with no deep packet inspection required. For most practical environments, this covers everything you need to understand what's running across your endpoints and where bandwidth usage is going. When you need granular visibility into your netflow monitoring data beyond the defaults, the custom sensor variants let you define your own channel logic.

Predefined traffic categories including Remote Control (RDP, SSH, Telnet, VNC), Infrastructure (DHCP, DNS, ICMP, SNMP), Citrix, Mail, NetBIOS, and Other Protocols
Filter options to isolate traffic by application category
Custom sensor variants available for non-standard classifications
Works across NetFlow v5/v9, IPFIX, jFlow, and sFlow
Port/protocol-based classification, not deep packet inspection

See Why IT Professionals Trust PRTG

Start monitoring your infrastructure in minutes. No professional services, no complex configuration, no risk.

Free download

PRODUCT OVERVIEW

NetFlow Analysis That Works Across Your Entire Stack

A lot of monitoring tools are built with Cisco as the default assumption. If your environment runs Juniper, Fortinet, HP/Aruba, or a mix, you're either excluded or left with limited support.

PRTG has native sensors for every major flow export format. One thing worth noting on sFlow: it works by sampling every n-th packet rather than analyzing all traffic, which means less device-side overhead with the tradeoff that you're working from sampled data. For most network traffic monitoring and troubleshooting use cases on routers, switches, and firewalls, that's more than enough. All protocols get the same Toplist view and filtering capabilities inside PRTG, regardless of vendor mix.

NetFlow v5 and v9: Cisco and compatible devices
IPFIX: vendor-neutral, widely supported across modern hardware
jFlow v5: Juniper routers and switches
sFlow: HP/Aruba, Fortinet, and others

The Traffic Data You Need to Make Upgrade Decisions

Capacity decisions carry more weight when they're backed by months of actual traffic data. Whether a link is undersized or consuming more resources than necessary, PRTG stores historical flow data and visualizes network bandwidth trends over time per interface. You can identify when peak usage actually happens, track sustained performance issues across links, and walk into upgrade discussions with performance metrics instead of gut feel.

Historical traffic trend graphs per interface
Peak utilization identification over configurable time ranges
Sustained high-utilization alerting
Long-term visibility across devices and interfaces
Enough traffic data to justify an upgrade, or argue against one

How PRTG Monitors NetFlow Traffic

Here's how flow data gets from your devices into PRTG, what the collector and analyzer setup looks like in practice, and what other network monitoring methods are available when flow export isn't an option.

Flow Data Collection

You configure your routers, switches, and firewalls to export flow records to PRTG's IP address and listening port. PRTG receives and processes those records directly. No separate collector software, no intermediate agent between your network devices and the data. This works on-premises with your existing infrastructure, without additional software components.

NetFlow v5 uses fixed fields and is straightforward to configure. NetFlow v9 and IPFIX use flexible, template-based structures that allow more granular netflow monitoring and data export. sFlow sends sampled packet data rather than full flow records, which keeps device-side overhead low.

Sensor Variants

PRTG's standard flow sensors come with predefined channel structures, ready to use with no additional setup. If your environment has non-standard traffic mixes or you need specific reporting logic, PRTG also offers custom sensor variants: NetFlow v5 (Custom), NetFlow v9 (Custom), IPFIX (Custom), jFlow v5 (Custom), and sFlow (Custom). Each of these lets you define your own channel filters for deeper network traffic analysis.

Also, flow sensors carry a very high performance impact rating. PRTG's documentation is specific: no more than 50 per probe. If you're running a larger environment, distribute the load across additional remote probes. One per location or network segment is the practical approach, and that's how you keep scalability without overloading any single probe.

SNMP Traffic Monitoring

Not every device supports flow export. Older hardware, access-layer switches, and devices where enabling flow export isn't practical still need coverage.

PRTG's SNMP Traffic v2 Sensor handles this: as a network performance monitor at the interface level, it gives you total in/out traffic, error and discard counts, and packet type breakdowns. It's currently in beta, so settings may still change, but it's a practical option for filling coverage gaps in mixed environments where flow export isn't available.

Note: This sensor is in beta status. The operating methods and the available settings are still subject to change. Do not expect that all functions work properly, or that this sensor works as expected at all.

Threshold-Based Alerting

Each flow sensor supports configurable thresholds per channel. When traffic on a given interface or protocol category crosses your defined limit, PRTG sends an alert via email, SMS, or push notification. Custom notifications can also execute scripts or HTTP actions if you need to feed alerting into external integrations.

Thresholds are set at the sensor level, so you can define different limits per interface, per protocol category, or per site, with no manual checks needed as flow data arrives from your devices.

Dashboards and Visualization

Flow sensor data feeds directly into PRTG's customizable dashboards. You can build views that show network performance metrics, current utilization as reported by flow data, and Toplist breakdowns across multiple devices. Push those to a NOC screen or shared display and your team sees current utilization and Toplist breakdowns without digging through individual sensors.

Graphs are available per sensor for any time range within PRTG's data retention.

free downLoad

NetFlow Traffic Analysis: Manual Methods vs. PRTG

Capability	Without a dedicated tool Without a dedicated tool	With PRTG With PRTG
Flow collection	Without a dedicated tool Separate collector (nfdump, nfsen, etc.)	With PRTG Built into PRTG, no additional software needed
Protocol support	Without a dedicated tool Typically one vendor format	With PRTG NetFlow v5/v9, IPFIX, jFlow, sFlow
Traffic breakdown	Without a dedicated tool Interface totals only (SNMP)	With PRTG Top Talkers, Top Connections, Top Protocols
Alerting	Without a dedicated tool Manual threshold checks	With PRTG Configured per sensor, automated notifications
Historical trends	Without a dedicated tool Separate logging infrastructure	With PRTG Native storage and visualization in PRTG
Multi-site visibility	Without a dedicated tool Per-site tools or none	With PRTG Remote probes, all sites, one platform*

*Remote probes need to be installed and configured at each site. They're not zero-effort, but once they're in place, everything flows into a single PRTG instance.

free downLoad

“PRTG helps us to keep control of our IT by making issues visible immediately – and everywhere. We always have an eye on the performance and availability of our IT and can react in time if any failures occur. On a long-term perspective, the monitoring data helps us with capacity planning so that we can deliver the required resources for our own systems as well as for our customers, without wasting money on unwarranted redundancies.”

Stein Erik Høybakk, Senior Network Engineer

TAFJORD

“All our production and business processes depend on SAP. But, of course, IT and production systems also play a crucial role in securing these processes. By incorporating SAP, production, and IT into one centralized monitoring system, we can quickly detect critical drops in performance and identify the causes of these issues. In fact, thanks to PRTG and itesys, this couldn’t be any easier.”

Andreas Schmidt, Senior Systems Engineer

Truma

“Any downtime could be detrimental to our customers. We also strive to provide the best possible service to our customers. PRTG allows us to see the health and performance of the network. Using these measurements we can make decisions on how to repair a piece of equipment before it fails and causes a service interruption.”

James Ott Jr., Communications System Technician and IT Administrator

Federal Radio

Paessler PRTG Network Monitor licenses & pricing

Choose the PRTG Network Monitor subscription that's best for you.

License Name	Price	License Details	Get started	Pricing Details
PRTG 500	^$200	per month paid annually	Buy now Buy now	Enough to monitor multiple aspects of 50 devices
PRTG 1000	^$358	per month paid annually	Buy now Buy now	Enough to monitor multiple aspects of 100 devices
PRTG 2500	^$742	per month paid annually	Buy now Buy now	Enough to monitor multiple aspects of 250 devices
PRTG 5000	^$1,300	per month paid annually	Buy now Buy now	Enough to monitor multiple aspects of 500 devices
PRTG 10000	^$1,642	per month paid annually	Buy now Buy now	Enough to monitor multiple aspects of 1000 devices

Over 100,000 Customers Worldwide Love Paessler

NetFlow Traffic Analysis: Frequently Asked Questions

Q: What's the difference between NetFlow v5, NetFlow v9, and IPFIX?

NetFlow v5 is the older, simpler format: fixed fields, limited flexibility, but universally supported on Cisco gear. NetFlow v9 introduced a template-based structure, which means vendors can define what fields get exported and how. IPFIX is the IETF-standardized version of v9, with the same flexible approach but vendor-neutral and increasingly common on non-Cisco hardware. If your devices support any of the three, PRTG has a sensor for it.

Q: Does PRTG work with non-Cisco routers and switches?

Yes. PRTG has native sensors for jFlow v5 (Juniper), sFlow (HP/Aruba, Fortinet, and others), and IPFIX (supported across most modern vendors). You're not limited to Cisco NetFlow. Mixed environments where you have Cisco in the core and Juniper or Fortinet at the edge work fine because each device just exports to PRTG in its native format.

Q: Do I need to install a separate NetFlow collector alongside PRTG?

No. PRTG handles collection and analysis in one. Your routers and switches export flow records directly to PRTG's probe: no nfdump, no nfsen, no intermediate software to maintain. That's one fewer piece of infrastructure to manage and one less thing that can break between your network devices and your visibility.

Q: How does PRTG handle high-volume flow environments?

Flow sensors are resource-intensive. PRTG rates them as very high performance impact, and the documentation recommends a maximum of around 50 flow sensors per probe. For larger environments, the right approach is distributing sensor load across additional remote probes. Each probe handles its local traffic volume; PRTG aggregates everything centrally. More setup work upfront, but that's how you optimize network management across bigger deployments without running into probe performance problems down the line.

Q: When should I use flow monitoring instead of SNMP, or should I use both?

SNMP gives you interface-level totals: in/out traffic, errors, discards. It's lightweight and works on almost any device. Network flow monitoring gives you the breakdown: who's talking, to what, over which protocol, using how much of your network resources. If you need to troubleshoot a performance issue or understand application-level traffic patterns, SNMP alone won't get you there. In practice, most network teams run both. SNMP for broad coverage across all devices, flow sensors where application-level visibility matters most.

Q: How is PRTG priced compared to tools like SolarWinds NTA?

PRTG is licensed by sensor count: no separate NetFlow module, no add-on pricing for flow analysis. What you pay scales with what you actually monitor. For teams evaluating alternatives like SolarWinds NTA, it's worth mapping out total sensor counts and any module costs before comparing list prices. The difference tends to be significant.

Q: Does PRTG support NetStream (Huawei)?

Not natively. There's no dedicated NetStream sensor in PRTG. Some Huawei devices can be configured to export flow data in IPFIX-compatible format, which PRTG's IPFIX sensor can receive. Whether that works depends on your specific device model and firmware. If you're running Huawei hardware and need flow visibility, check your device documentation for IPFIX export support before assuming it'll work out of the box.