"The internet is slow" has three different questions hiding inside it: is the line full, who filled it, and with what? PRTG has three bandwidth methods because no single one answers all three.
Every bandwidth argument in an office is really three arguments. SNMP tells you the line is full. Flow tells you which machine and which kind of traffic filled it. The Packet Sniffer does the same detective work where flow does not exist. Paessler's own manual compares exactly these methods - totals versus toplists. Picking the wrong one gives you beautiful graphs that cannot answer the question you actually asked.
The SNMP Traffic sensor polls the counters of one interface on a router or switch: bytes in, bytes out, errors. Setup is easy, the load on both device and PRTG is tiny, and it is rock reliable. Its limit is total blindness: PRTG's own comparison table marks it no filtering, no differentiation by protocol or IP, no toplists. It answers when and how much - never who. For most small offices, most days, "when and how much" is genuinely enough.
Flow-capable routers and switches summarise conversations - source, destination, protocol, volume - and export them to PRTG's flow sensors (NetFlow v5/v9, sFlow, IPFIX, jFlow). PRTG turns them into toplists: top talkers, top connections, top protocols. The cost is setup: the device must support flow export and be configured to send it, and flow sensors put more load on the probe as traffic grows. If your router cannot export flows, no setting in PRTG can invent them.
The Packet Sniffer sensor reads the headers of traffic passing the probe's network card - or a switch monitoring (SPAN) port - and sorts it into channels like web, mail, file transfer and remote control. It is the answer for networks whose gear exports nothing. The honest prices: it only sees traffic that actually passes its vantage point, and it is the heaviest method on the probe - Paessler recommends it for low-traffic connections (under roughly 50 Mbit/s steady) or on a dedicated remote probe. Point it at a saturated gigabit uplink and the watcher becomes the bottleneck.
Running all three everywhere is not thoroughness; it is probe load and sensor budget spent to feel safe.
Every sensor in this guide is created live in the video - installation, discovery, CPU and RAM, bandwidth and firewall status.
Watch Full VideoYes - that is exactly the Packet Sniffer's job. Feed it traffic through a switch monitoring port or place a probe where the traffic passes, and it builds top talker and protocol lists from packet headers instead of flow records.
Flow export is a designed-in router feature and light for typical office gear, but it is not zero, and the receiving probe works harder as flow volume grows. Start it on the WAN-facing device only, where the answers live.
SNMP Traffic on the uplink. It costs one sensor and nearly no load, proves whether the line really saturates, and tells you honestly whether the 'who' question even needs the heavier tools.