How can I monitor bandwidth usage
There are several methods for monitoring bandwidth usage, with different levels of granularity.
Be aware that some of these packages require full disk write access and thus are not available on NanoBSD installations (typically found on CF or SD card installs).
If a connection is currently active, connect to the pfSense router's console (physical access or ssh) and watch the traffic flow with pftop (Option 9).
The output can be changed to show several views (press 0-8 or 'v' to cycle) and may be sorted in various ways. Press "?" for a list of available command keys while running pftop.
Install iftop from the package list, then tun it from the shell (console or SSH) as follows:
iftop -nNpPi em0
Change em0 to be the interface that should be monitored.
In the above example, -nNpP tells iftop to not resolve hostnames (n) or port numbers (N), and to run in promiscuous mode (p) and also display ports in the output (P).
Press 't' to cycle through various views.
Another option for viewing real time throughput is trafshow. To install it, follow the example at Installing FreeBSD Packages using trafshow as the package name.
Once installed, run it at an SSH command prompt, run:
Then select the interface.
If overall per-interface usage is all that is required, there are built-in RRD graphs on pfSense, which can be found under Status > RRD Graphs.
If more detail is required, such as by client IP on the LAN interface, there is a package for bandwidthd that can be installed under System > Packages. Once installed, it appears under Services > BandwidthD.
Darkstat is also available in System > Packages. Once installed, it appears under Diagnostics > darkstat. It also offers bandwidth graphs for an interface, as well as traffic to/from specific IP addresses.
If even more detail is required, the ntopng package, which can also be found under System > Packages, can help. It can break down detail by IP, protocol, and so on. Once installed, it appears under Diagnostics > ntopng. It will even track where connections were made by local PCs, and how much bandwidth was used on individual connections.
The older ntop package has been replaced by ntopng.
Due to the disk resource requirements of ntop and ntopng, it is not available on NanoBSD. It is also not recommended for systems that have low CPU or RAM.
Monitoring on Multiple Interfaces
Currently, darkstat and bandwidthd do not listen on multiple interfaces. ntopng will listen on multiple interfaces.
Netflow is another option for bandwidth usage analysis. Netflow is a standard means of traffic accounting supported by many routers and firewalls. Netflow collector running on a host inside the network is required to collect the data. pfSense can export Netflow data to the collector using the softflowd package or the pfflowd package.
vnstat is another bandwidth monitoring tool available to install as a package. See Vnstat for more information