Quick easy way to see the bandwidth hog?

spyshagg

I made "kind of" the same question here: https://forum.pfsense.org/index.php?topic=118696.0

There is a software that can be used (ntopng)

I'm also interested to know alternatives to ntopng

JeGr

What about running pftop, iftop or using the RRD_summary or Status_Traffic_Totals package / extensions?

KOM

I keep a page open for Traffic Graph with the following settings:

Interface: LAN
Sort By: Bandwidth Out
Filter: Local
Display: Hostname

spyshagg

traffic graphs only show the real-time stats per interface. I have 32 vlans..

KOM

I have 0 VLANs, so it works well for me.

JeGr

Again: what about using the tools like pftop or iftop package to quickly identify bandwith hogs at that very moment? If you need historical data, then the other two packages would be of help without needing a complete ntopng installation. Just IMHO.

spyshagg

pftop, iftop, traffic charts, only display the realtime traffic of one single chosen interface. I have 32 Vlans, so 32 interfaces. I would have to cycle each one of the 32 interfaces to try and find the culprit quickly.

JeGr

Why? You have one WAN interface where all your VLANs go to the internet. Why do you have to monitor all VLANs if you can simply see the culprit on the WAN side!?

spyshagg

Wan only shows traffic from its own subnet (when local is selected) or public ips (when all is selected). Internal traffic is not visible on my wan. should it be?

robatwork

@KOM:

I keep a page open for Traffic Graph with the following settings:

Interface: LAN
Sort By: Bandwidth Out
Filter: Local
Display: Hostname

This is the closest thing to what I want that I can get without extra packages, so you win today's pfSense gold (plated) hat. Ta

JeGr

Wan only shows traffic from its own subnet (when local is selected) or public ips (when all is selected). Internal traffic is not visible on my wan. should it be?

OP was talking about hogging traffic on the WAN interface so that is what I was responding to. Looking at pftop you can select various infos. E.g. I see the internal IP under the GW column when looking at the WAN interface and sorting it by bandwith usage/rate/etc. you can quickly identify the hog if I don't misunderstand what robat is trying to do.

spyshagg

You are correct, it relates well to Op question. My created-topic with a similar problem however remains empty :)