Understand how your network really uses the internet.
Bandwidth, sites, cloud apps and users — a modern, honest reference for the people who run networks. Clean visibility, without overspending or crossing privacy lines.
Which monitoring tool should I use?
Tune the four inputs — the recommendation updates as you go.
Live top-talkers and per-app breakdown straight from flows or a SPAN port.
A starting point, not a verdict — most shops end up combining two of these sources.
Five sections, sixteen articles.
Browse by topic — jump into a section and read article-to-article.
Fundamentals
What network-usage monitoring is, what it can and can't tell you, and the four data sources it draws on — logs, flows, packets and DNS.
Bandwidth & Traffic
Find what's eating the link: bandwidth hogs, top talkers, interface saturation, and reading NetFlow without a full-time analyst.
Web & App Usage
See which sites and cloud/SaaS apps people actually use — shadow IT, DNS-level visibility, and the email & print usage the old suite also covered.
Choosing & Deploying
Pick and roll out the right tool: what actually matters, self-host vs cloud, modern alternatives, and alerting that doesn't cry wolf.
Legacy
Where the name comes from — Red Line Software's Internet Access Monitor, Mail Access Monitor and Printer Activity Monitor. One small, factual, historical page on the pioneers of turning access logs into readable usage reports.
Every tool, side by side.
Thirteen tools we name factually across the guide. Filter by where it runs, its data source, or cost.
Tool comparison
13/13| Tool | Sees | Source | Host | Free | Best for |
|---|---|---|---|---|---|
| ntopng ↗The modern heir to per-user/per-app usage reporting. | Real-time traffic, flows, per-host & per-app usage | Packets / NetFlow | Self-host | Free (community) + paid | Deep real-time traffic visibility |
| PRTG ↗Sensor-based; easy start for SMB. | Bandwidth, interfaces, flows | SNMP / NetFlow / packet sniffing | Self-host | Free up to 100 sensors | All-in-one for a small/mid office |
| LibreNMS ↗Great SNMP graphing with autodiscovery. | Interface bandwidth, device health | SNMP | Self-host | Free / open-source | Auto-discovered device & bandwidth graphs |
| Zabbix ↗Flexible but heavier to set up. | Infrastructure + network metrics | SNMP / agents | Self-host | Free / open-source | Broad infrastructure monitoring |
| ElastiFlow ↗Turns raw flow into searchable dashboards. | Flow analytics, top talkers | NetFlow / IPFIX / sFlow | Self-host / cloud | Free community tier | Flow analytics at scale |
| Wireshark ↗For investigation, not continuous usage reporting. | Packet-level detail | Packet capture | Self-host | Free / open-source | Deep ad-hoc packet inspection |
| Pi-hole ↗See every lookup without touching content. | DNS queries, blocked domains | DNS | Self-host | Free / open-source | DNS visibility & filtering (home/small) |
| NextDNS ↗Cloud DNS resolver with analytics & filtering. | DNS activity, per-device | DNS | Cloud | Free tier | DNS visibility for remote / WFH |
| pfSense / OPNsense ↗Add-on packages surface per-host usage. | Gateway traffic (via pfTop, ntopng, Squid) | Firewall / proxy logs | Self-host | Free / open-source | Gateway-level usage on the firewall |
| Squid + SARG ↗The most direct descendant of Internet Access Monitor. | Per-user web usage from proxy logs | Proxy log | Self-host | Free / open-source | Classic proxy-log usage reports |
| Cisco Umbrella ↗Scales DNS visibility across remote users. | DNS-layer usage & threats | DNS | Cloud | Paid (trial) | Enterprise DNS visibility |
| Netskope ↗Sees SaaS usage a network monitor can't. | SaaS / cloud-app usage (shadow IT) | Inline / API (CASB) | Cloud | Paid | Cloud-app & shadow-IT visibility |
| Netdata ↗Very high-resolution live metrics. | Real-time per-node metrics incl. network | Agent | Self-host / cloud | Free tier | Real-time granular per-node monitoring |
Pricing is qualitative on purpose — tiers, not exact figures, which change. Each tool links to its own official page. No star ratings, no "get deal": pick for fit, not for a badge.
Where admins usually start.
Finding the Bandwidth Hogs
From "the link feels slow" to a named user, host or app in an afternoon — starting at the WAN interface, dropping to flows, and never touching packet contents.
Read the how-to →
Logs vs Flows vs Packets vs DNS
Four windows into your network — each shows a different angle, none shows everything.
DNS-Level Visibility with Pi-hole & NextDNS
The cheapest, most privacy-clean lens on web usage — every device asks DNS before it connects.
Seeing Which Sites & Cloud Apps Get Used
In an HTTPS world you can't read pages — but DNS and SNI still reveal the destinations and shadow IT.
Reading NetFlow Without an Analyst
What a flow record is and isn't, how to export it, and how a collector turns it into ranked usage.
Choosing Monitoring Software: What Actually Matters
Scope your own needs before you shop — four criteria that actually separate the tools.
The Story of Internet Access Monitor
How a small software house turned proxy logs into office visibility — and why the idea never went away.
