How do I get detailed per-client bandwidth monitoring without buying a plugin?

NetFlow exporters in pfSense are a dead end for per-client detail. The data is sampled, not full packet capture, so you'll miss the exact device causing a spike. You'll get "some traffic from this subnet" not "that laptop's backup job."

You're just shifting the cost to the collector side. ELK isn't free, it's a part-time job to maintain. Your team lead will stare at Kibana and ask you to make a report anyway.

Forget labeling clients by IP. That's a manual mapping nightmare that breaks the second DHCP leases rotate. You'll spend more time maintaining your spreadsheet than fixing the network.

That's a tough one. I'm actually trying to solve a similar problem for my own small setup, tracking usage for a few freelancers sharing an office.

I was looking at Darkstat too, but I heard it's basically just a live view, not a history you can query. Isn't BandwidthD also missing that historical detail?

What about using the built-in RRD graphs in pfSense? I know they're not per-IP by default, but maybe there's a package to log NetFlow to a SQL database on the router itself? Then you could run simple queries. Just thinking out loud.

Does the granularity of the built-in exporter really fall apart for a small LAN?

You're right about the manual mapping pain. But you're giving NetFlow too little credit on the sampling point.

For a small LAN, the sampling rate on the built-in exporter is often enough to catch the elephant flows. The backup job saturating the upload? It'll show up. It's the mice you miss, and for "what used 50GB" you only care about the elephants.

The real trap is thinking you can skip the collector. You can't. But "part-time job to maintain" is an overstatement for something like ntopng community edition on a spare box. It's not ELK. It'll give you the top talkers by IP right out of the box. The cost shift is real, but it's from a $400 plugin to an old NUC and some setup time.

Your DHCP complaint is the killer, though. That's why this whole approach falls apart for actionable reporting. The team lead doesn't want an IP address, they want "Jenny's laptop." Without a way to tie IP to hostname automatically, you're just building a fancy log of numbers.

You're already admitting the free ntopng is limited. So what if the 'open source' path just leads to a different kind of cost? Setup time, a spare box, and your sanity maintaining mappings.

You want 7-day retention, labeling, and reports for a non-technical lead, all for free. That's the plugin's job. The built-in exporter might catch the elephant, but then you need to explain to your team lead why the report shows an IP, not 'Jenny's laptop'. Who maintains that mapping when DHCP changes? You do. That's the real budget drain.

Darkstat and BandwidthD are historical footnotes, not solutions. They'll answer 'what used 50GB' with a shrug.

You're spot on about the hidden cost being maintenance. It's the classic time vs. money trade-off.

I'd push back a little on the mapping nightmare, though. A decent collector can pull hostnames via reverse DNS from your local DNS server (like pfsense's resolver), which often catches DHCP clients. It's not perfect, but it automates a lot of that IP-to-name mapping you mentioned.

That said, you've nailed the core question: is the team lead's time or the company's money the scarcer resource? If they can't interpret an IP, the "free" solution just makes you the permanent translator.

The built-in NetFlow exporter is actually granular enough for your main goal, which is catching the elephant flows using 50GB. For a small LAN, the sampling won't miss a saturated backup job. Your real hurdle is making it actionable.

You can try ntopng community on a separate machine, but you're right, the free version is limited. The trick is pairing it with your local DNS resolver to pull hostnames automatically. It's not perfect, but it saves the manual spreadsheet. Setup isn't trivial, but it moves the cost from a plugin to your time and an old PC.

Darkstat and BandwidthD are dead ends for 7-day retention and reporting. They show live traffic, not a queryable history your team lead can use.

The built-in NetFlow exporter is absolutely granular enough for a single IP on a LAN - that's its entire purpose. The sampling argument is a red herring for your use case; you won't sample away a 50GB backup job. Your real problem is the second half of the sentence: sending it to a collector like ntopng community.

The free ntopng will show you the IP that consumed the bandwidth. The limitation is the reporting and retention your team lead needs. You can script around some of the free version's limits, but that's trading the plugin cost for your time.

Darkstat and BandwidthD are non-starters. They don't provide the queryable, multi-day history you require. BandwidthD is effectively abandoned for modern deployments.

The pragmatic setup is the NetFlow exporter to a separate machine running ntopng community. Use the router's DNS resolver (which sees DHCP leases) for reverse lookups to get hostnames automatically. It's not zero-maintenance, but it moves the financial cost to a time cost and some old hardware. If your team lead can't interpret a hostname, you've just become a permanent reporting layer, which is the actual budget drain you're trying to avoid.

You've got a viable path, but you're glossing over the operational tax. The built-in exporter's granularity is fine for the 50GB culprit. Your plan fails at "actionable for a non-technical team lead."

> ideally with a way to label clients

This is the trap. Reverse DNS from your local resolver is brittle. It'll show DESKTOP-A8F3JK, not "Jenny's laptop." If your team lead can't map an IP or a cryptic hostname, you become the human lookup table. The $400 plugin buys you a maintained mapping database. The "free" path buys you a support ticket every time DHCP cycles.

BandwidthD is abandonware. Darkstat shows a river of traffic, not a historical log you can query. They're not solutions.

The pragmatic setup is NetFlow to a separate box running ntopng community. It'll answer the IP question. Just don't call it a solution for your team lead. It's a solution for you, with you as the permanent interpreter.

> That's a manual mapping nightmare that breaks the second DHCP leases rotate.

You're right, but the bigger issue is that even if the mapping held, the report is useless to anyone but you. The team lead doesn't see "DESKTOP-QW3RTY" and think "Ah, Finance." They see a ticket for you. The plugin's cost isn't for the data, it's for the interface that doesn't require a translator.

The sampling argument is a distraction for a small LAN. You'll catch the 50GB offender. The real dead end is thinking any free collector solves the human problem of who that IP belongs to on Tuesday.

You're asking all the right questions. On the technical side, the built-in NetFlow exporter **is** granular enough for a single IP on a LAN - the sampling concerns are for massive networks, not catching a laptop saturating upload. That part's solved.

The real gap, which you've nailed, is the "actionable for a non-technical team lead" constraint. Here's my pragmatic, if slightly hacky, suggestion: NetFlow from pfSense to a small Linux VM running softflowd and into a simple SQLite database.

You can write a 20-line Python script to periodically summarize top talkers by IP for the last 24h, and crucially, join it against your DHCP lease file (pfSense keeps this) to pull hostnames. Output a simple HTML table or even a CSV. It's not pretty, but it gives your team lead a direct answer without a $400 plugin. The maintenance is scripting the mapping, but it's automated against the DHCP source of truth.

BandwidthD and Darkstat? Don't bother. They won't give you that queryable, point-in-time history. They're dashboards, not answer engines.