Comparison of SNMP, Packet Sniffing and Netflow

Depending on your infrastructure you can monitor the usage of your network using the three different protocols supported by PRTG Network Monitor: SNMP, Packet Sniffing, and Netflow. The animations below illustrate for each option how PRTG collects the data.


The Simple Network Management Protocol (SNMP) is the most basic method of gathering bandwidth and network usage data. It can be used to monitor bandwidth usage of routers and switches port-by-port, as well as device readings like memory, CPU load, etc.

Data Acquisition Using SNMP

When this technology is used PRTG queries the devices (e.g. routers, switches, and servers) for the traffic counters of each port. This option creates the least CPU load and network load of the three methods.


Packet Sniffing in LANs

If you need to know what applications or IP-addresses are causing the traffic in your network you can use a Packet Sniffer which looks at every single data packet travelling in your network for accounting purposes. PRTG can analyze the packets passing the network card of a PC or it can be connected to a so-called monitoring port of a switch.

Data Acquisition Using Packet Sniffing (LAN)

In order to calculate bandwidth usage PRTG inspects all network data packets either passing the PC's network card (shown on the left side) or the data packets sent by a monitoring port of a switch (right side) with its built-in Packet Sniffer. From the three technologies shown here this one creates the most CPU and network load. For larger networks PRTG offers remote probes that distribute the load and assure maximum performance.


NetFlow Protocol

Professional routers and switches from vendors like Cisco, HP, Juniper, and others support NetFlow or sFlow export for bandwidth usage monitoring. It is the most powerful monitoring method, suitable for high traffic networks.

Data Aquisition Using Cisco's NetFlow Protocol

Cisco devices with NetFlow support track the bandwidth usage of the network internally and then only send pre-aggregated data to the PRTG system for accounting purposes. This way the computing load for PRTG is much lower.


More Information

If you are interested in a more detailed description of bandwidth monitoring for various network infrastructures please check out the following knowledge base articles: