Monitoring Bandwidth Usage¶
With pfSense® software, there are several methods for monitoring bandwidth usage, with different levels of granularity.
If a connection is currently active, connect to the firewall console (physical
access or ssh) and watch the traffic flow with pftop (Option
The output can be changed to show several views (press
cycle) and may be sorted in various ways. Press
? for a list of available
command keys while running pftop.
iftop from the shell (console or SSH) as follows:
iftop -nNpPi em0
em0 to an appropriate interface to monitor.
In the above example,
-nNpP tells iftop to not resolve hostnames (
port numbers (
N), and to run in promiscuous mode (
p) and also display
ports in the output (
t to cycle through various views.
Another option for viewing real time throughput is trafshow, which can be
installed from the CLI with
pkg install trafshow followed by
Once installed, run it at an SSH command prompt:
Then select the interface.
If overall per-interface usage is all that is required, there are built-in RRD graphs in pfSense software, which can be found under Status > Monitoring.
If more detail is required, such as by client IP on the LAN interface, there is a package for bandwidthd that can be installed under System > Packages. Once installed, it appears under Diagnostics > BandwidthD.
Darkstat is also available in System > Packages. Once installed, it appears under Diagnostics > darkstat. It also offers bandwidth graphs for an interface, as well as traffic to/from specific IP addresses.
If even more detail is required, the ntopng package, which can also be found under System > Packages, can help. It can break down detail by IP, protocol, and so on. Once installed, it appears under Diagnostics > ntopng. It will even track where connections were made by local PCs, and how much bandwidth was used on individual connections.
Due to the resource requirements of ntopng, it is not suited for with low CPU or RAM.
Monitoring on Multiple Interfaces¶
Currently, darkstat and bandwidthd do not listen on multiple interfaces. ntopng will listen on multiple interfaces.
Netflow is another option for bandwidth usage analysis. Netflow is a standard means of traffic accounting supported by many routers and firewalls. Netflow collector running on a host inside the network is required to collect the data. pfSense software can export Netflow data to the collector using the softflowd package.