Quick easy way to see the bandwidth hog?

[robatwork]

pfSense 2.3.2 setup with 3 x WAN connections.

I keep the dashboard open. On occasion I need to quickly see what's making the upload or download on one of the WANs saturate.  Is there an easier quicker way than by going into Diagnostics/States then filter by WAN, and scroll down to hopefully see the culprit?

tia

[spyshagg]

I made "kind of" the same question here: https://forum.pfsense.org/index.php?topic=118696.0

There is a software that can be used (ntopng)

I'm also interested to know alternatives to ntopng

[JeGr]

What about running pftop, iftop or using the RRD_summary or Status_Traffic_Totals package / extensions?

[KOM]

I keep a page open for Traffic Graph with the following settings:

Interface: LAN
Sort By: Bandwidth Out
Filter: Local
Display: Hostname

[spyshagg]

traffic graphs only show the real-time stats per interface. I have 32 vlans..

[KOM]

I have 0 VLANs, so it works well for me.

[JeGr]

Again: what about using the tools like pftop or iftop package to quickly identify bandwith hogs at that very moment? If you need historical data, then the other two packages would be of help without needing a complete ntopng installation. Just IMHO.

[spyshagg]

pftop, iftop, traffic charts, only display the realtime traffic of one single chosen interface.  I have 32 Vlans, so 32 interfaces.  I would have to cycle each one of the 32 interfaces to try and find the culprit quickly.

[JeGr]

Why? You have one WAN interface where all your VLANs go to the internet. Why do you have to monitor all VLANs if you can simply see the culprit on the WAN side!?

[spyshagg]

Wan  only shows traffic from its own subnet (when local is selected) or public ips (when all is selected).  Internal traffic is not visible on my wan. should it be?

[robatwork]

@KOM:

I keep a page open for Traffic Graph with the following settings:

Interface: LAN
Sort By: Bandwidth Out
Filter: Local
Display: Hostname

This is the closest thing to what I want that I can get without extra packages, so you win today's pfSense gold (plated) hat. Ta

[JeGr]

Wan  only shows traffic from its own subnet (when local is selected) or public ips (when all is selected).  Internal traffic is not visible on my wan. should it be?

OP was talking about hogging traffic on the WAN interface so that is what I was responding to. Looking at pftop you can select various infos. E.g. I see the internal IP under the GW column when looking at the WAN interface and sorting it by bandwith usage/rate/etc. you can quickly identify the hog if I don't misunderstand what robat is trying to do.

[spyshagg]

You are correct, it relates well to Op question.  My created-topic with a similar problem however remains empty :)