I use port mirroring to capture traffic from my switch, this feature works great. The Top Connections report every 15 minutes has helped diagnose a few problems already. However, I need to take this to the next level, I need to take the data that is already there (say for the prior days 24 hour period) and filter out just specific source or destination IP addresses. Since the data is there I would imagine this should be simple.

Thanks!

Article Comments

Dear David,

I'm sorry but Toplist data cannot be reported. You can use Custom Sniffer Sensors or Filters on normal Sniffer Sensors though to only monitor traffic for certain IPs: https://kb.paessler.com/knowledgebase/en/topic/473
https://kb.paessler.com/knowledgebase/en/topic/483
On the normal sensor historic data reports are then possible.

best regards.


Feb, 2012 - Permalink

Where is the toplist data stored so that I can access it outside of the interface?


Feb, 2012 - Permalink

The Toplist data is stored in proprietary database files, in the PRTG Datafolder.


Feb, 2012 - Permalink

Why is it not possible to view data/traffic for all IP addresses? I have many "Other" toplists which I cannot see IP addresses for. I have tried reducing the Period to 1 min, top count to 1000 and memory limit to 100 and 45% of my toplist is still "Other". If there was a report/export that showed traffic by IP address this would shed some light on who is part of that "Other" group. What solution do you recommend to list packet sniffing traffic by IP address withing PRTG? Thanks.


May, 2012 - Permalink

You could use several Sniffer Sensors with filters on them to reduce the amount of data for each sensor.


May, 2012 - Permalink

Sorry for asking in an old thread but is it realy impossible to report the top connections neither with the current version?


Dec, 2016 - Permalink

Dear Michael_S,

While you can use toplists to see "snapshots", PRTG does not store netflow/packet sniffer data in a way that allows extensive reporting, I´m afraid.

Kind regards,
Sven


Dec, 2016 - Permalink

Hi Sven,

I understand that extensive reporting can cause high database hits, but a nice feature would be a export function because it is very complex to save the data by cut copy & paste to an excel sheet.

Kind regards, Michael


Dec, 2016 - Permalink

Hello Michael_S,

Thank you for your reply.

While I absolutely agree with you and it would be a formidable addition to PRTG, I wouldn't expect this feature to get implemented anytime soon.

We have looked into this in the past and there are several considerations that need to be taken into account, for instance the amount of data that needs to be store and the "performance" of such reporting feature.

So while we would love to offer this feature, there are a few obstacles that we need to address first.

Best regards,
Sven


Dec, 2016 - Permalink