I need to find a solution to monitor, in real-time, the traffic currently used by an office of about 25 peoples. We already have Zenoss for SNMP monitoring, but I'm looking more at something that would tell me who is using most of the bandwidth "right now". Something similar to this interface: ClearOS Network Traffic Report

Since ClearOS has this functionality, it must not be very hard to reproduce, yet I can't seems to find it in things like PFsense or in Cisco Small business routers.

Any suggestions?


Here are two other ways to accomplish this:

  1. Use PRTG in conjunction with a switch port monitor, if your switch supports port monitoring. You would configure the port to which PRTG is connected to monitor the port that links the switch to the router and create a packet sniffing sensor in PRTG. This is what I do in my office.

  2. Use Netflow in conjunction with a Netflow collector, if your switch or router supports Netflow. This is what I do in my datacenter.

  • +1 Using PRTG in a test right now and with netflow and switch port monitoring we can easily see real-time traffic and identify issues quickly. PRTG is a nice tool and not super expensive. Easy to install as well. – Dave M Jun 15 '11 at 0:19
  • It's certainly been helpful in identifying the bandwidth hogs in my office. :) – joeqwerty Jun 15 '11 at 0:21
  • Sadly, while both of these solution are very interesting, I would have to replace the entire network infrastructure. This is just for a small business with very basic switches (barely supporting SNMP) and a consumer-grade router. – ve2dmn Jun 15 '11 at 14:20
  • You could still accomplish this if you use a network tap. This article purports to show you how to build your own passive tap: instructables.com/id/Make-a-Passive-Network-Tap (take note that I've never used these instructions to build a network tap). You could also do this by putting a hub in line between the switch and router and plugging PRTG into the hub, although this is a less desirable way of doing it. – joeqwerty Jun 16 '11 at 2:15

If you're using Squid with PFSense (and I strongly suggest you do, in transparent mode it has almost no downsides), it can give you a real-time traffic log along with historical reports.

They're all listed as packages. Install the Squid one first, configure it as transparent, and then install the reporting packages.

If you're only after instant monitoring and not historical, I'm fairly sure there's a PFSense package for that too (without installing Squid), but I can't remember its name off the top of my head.


We use Smoothwall for our firewall and it has this kind of thing standard. Amongst other things there's a rather nice live graphical display showing the current traffic in and out, with each machine's IP address displayed. I find it very handy for locating torrent downloaders on the network. On the downside, the historical logging isn't as useful, except for the data for the firewall's own interfaces.


Take a look at NTop. It is like top, but for net interfaces and sockets.

  • I known about Ntop, but I want an aggregate of all the users and servers... – ve2dmn Jun 15 '11 at 14:21

A linux proxy running squid will do what you need. Squid even supports SNMP so you should be able to get this info into your Zenoss dashboard. http://www.squid-cache.org for more info

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.