This flow-based methodology provides a scalable and efficient way to understand bandwidth consumption without capturing full packet payloads. Flow data can provide an ongoing overview of your network traffic, as seen in Understanding the Difference: Flow Data vs. Packet Capture, making it well suited for continuous, network-wide visibility.

Platforms such as Nagios Network Analyzer (NNA) are able to collect and analyze this flow data, transforming raw traffic summaries into actionable insight that can be reviewed in both real-time and historical contexts.

Top talker analysis directly addresses one of the most critical operational questions in network management: where is the bandwidth being utilized?

Importance of Identifying Top Talkers

Identifying top talkers is fundamental to maintaining network visibility and control. Flow-based analysis supports informed decision-making across three primary operational domains: performance monitoring, security analysis, and capacity planning.

Performance Monitoring

High-volume traffic can saturate network links, increase latency, and degrade application performance. Without visibility into top talkers, performance issues often present as generalized slowness with no clear root cause.

Top Talkers enable administrators to correlate traffic patterns with performance degradation by identifying high-volume hosts, applications, or conversations across interfaces, protocols, and time periods. Because flow data is lightweight and continuously collected, it allows long-term analysis of traffic trends that would be impractical with packet capture alone.

This aligns with the broader distinction between flow data and packet capture: flow data excels at identifying where congestion exists, while packet capture is used later to understand why it exists.

Security Analysis

Top talker behavior can serve as an early indicator of potential security issues. Sudden increases in traffic volume, unexpected high-bandwidth internal hosts, or sustained outbound flows to unfamiliar destinations may indicate compromised systems, lateral movement, or data exfiltration.

Networking tools can help provide visibility into these behaviors through flow analysis and historical comparison. When suspicious traffic patterns are identified at the flow level, administrators can pivot to deeper inspection using packet analysis tools.

Nagios Network Analyzer supports this investigation workflow by integrating with Wireshark and Suricata, allowing analysts to move from flow-based detection to packet-level validation. This dual approach reflects best practices where flow data identifies anomalies and packet capture confirms intent and content.

Capacity Planning

Long-term top talker trends reveal how bandwidth is actually consumed over time, beyond short-lived utilization spikes. Persistent high-volume traffic sources highlight sustained demand and recurring usage patterns that directly inform infrastructure planning.

Using historical flow data enables you to make data-driven decisions around link upgrades, traffic segmentation, and QoS policy implementation. Administrators can track growth across hosts, applications, subnets, and interfaces, ensuring network capacity evolves in line with actual usage rather than assumptions.

Identifying Top Talkers Using Flow Data

Flow data enables scalable top talker identification without the overhead and storage requirements of full packet capture. Traffic can be ranked and analyzed across multiple dimensions, including:

• Source or Destination IP to identify hosts responsible for the highest volumes of sent or received traffic.
• Source–Destination Conversations to highlight bandwidth-intensive communication paths.
• Application or Protocol to determine which services dominate network usage.
• Interface, Subnet, or Autonomous System for boundary-level and link-focused analysis.

Because flow records are time-based, administrators can compare traffic across intervals to identify short-lived spikes, sustained heavy usage, or gradual growth trends. This makes top talker analysis one of the most common and effective entry points for ongoing network analysis.

Visualization and Analysis in Nagios Network Analyzer

Visualization transforms top talker data into actionable intelligence by making traffic patterns immediately understandable. Nagios Network Analyzer provides multiple ways to explore and analyze network traffic behavior, including:

• Ranked tables that present hosts, applications, conversations, and interfaces in descending order by traffic volume, allowing administrators to quickly identify the most significant consumers of bandwidth.
• Time-series graphs that display traffic levels over selected time ranges, making it easier to recognize peak utilization periods, recurring usage patterns, and deviations from established baselines.
• Drill-down views that enable administrators to move from high-level summaries into detailed flow-level analysis, providing granular visibility into specific interfaces, hosts, protocols, or source–destination conversations.

When deeper inspection is required, Nagios Network Analyzer supports exporting traffic data to Wireshark for packet-level analysis and scanning captured traffic with Suricata for security alerting. This integrated workflow allows teams to determine whether high-volume traffic is expected, misconfigured, or indicative of malicious activity, supporting accurate root cause analysis and faster remediation.

Alerting on High-Volume Traffic

Nagios Network Analyzer supports flow-based alerting using clearly defined numerical thresholds. Alerts can be configured to trigger when traffic volumes—measured in bytes, packets, or flows—exceed or fall below expected values based on specific traffic criteria, including:

• Source, destination, or bidirectional traffic, allowing administrators to monitor inbound, outbound, or total traffic volumes and detect abnormal changes affecting network performance.
• Specific IP addresses, networks, or subnets, enabling targeted alerting for critical systems, sensitive network segments, or high-risk external endpoints.
• Ports and protocols, which make it possible to alert on traffic associated with particular services or applications and identify unexpected or unauthorized usage.

This threshold-based alerting model ensures notifications are tied to measurable network impact and observable traffic behavior. By focusing on flow metrics rather than packet inspection or unsupported ranking logic, Nagios Network Analyzer enables reliable, scalable alerting that supports proactive response across large and complex networks.

Summary

Network top talkers provide a focused, high-value perspective on how traffic moves through an environment. By analyzing flow data, organizations can quickly determine which hosts, applications, and conversations consume the most bandwidth and how that usage changes over time. This visibility turns abstract utilization metrics into clear, operational insight.

When top talker analysis is combined with visualization and threshold-based alerting, it enables teams to detect performance degradation, uncover abnormal or risky traffic behavior, and plan infrastructure growth based on real usage patterns rather than assumptions. Flow-based insight supports both immediate troubleshooting and long-term strategic planning, making top talker analysis a foundational technique for modern network operations.

To learn more, visit the Nagios Network Analyzer product page and review the Nagios Network Analyzer 2026 update.

1. Using the Report

To access the report, navigate to the Reports menu, then select Capacity Planning. Next, select the Period (how far into the future you want to project), and select the specific Host, Hostgroup, or Servicegroup to graph the results for.

Once you make all of your customization selections, you can then save, email, export, and even (another great Enterprise Edition feature) schedule the report for automatic delivery at set times.

Alternately, you can navigate to the Status Detail page for a service and go to the Capacity Planning tab to view projections.

The options tabs to the right of the initial graph provide access to a data Summary, all of the individual data points, and the option to customize your Time Period and Extrapolation Method.

2. Adding Graphs to Dashboards

You’ll notice the Dashify icon on the upper left of each Capacity Planning graph, which you can click to easily add them to your Dashboards. This provides an easy way to quickly access at-a-glance projections for key services in your environment and to roll them into other Dashboards you’ve created.

3. Using the Wizard

It’s even possible to set up alerts on projections using the Capacity Planning Wizard, found in the Configure > Configuration Wizards menu. In Step 1 you’ll choose which service to monitor. Then in Step 2 you’ll choose how far ahead the check should look, what algorithm it should use, the projected value at which you want to be alerted, and how many days in advance of the resource hitting the custom value you wish to be alerted.

You can choose to either add the newly created services to the host under which the services producing the performance data reside or check the “Put all new services on a specific host” checkbox to assign them elsewhere (for example, to a dummy host reserved just for capacity planning checks).

You can click the Render Graph link at the bottom of the wizard to see a graph of current and projected data and to see where your Custom Value selection falls within it.

Once the checks are created, you can monitor them like any other service or even roll them into your Business Process Intelligence groups:

Resources

For a more detailed overview of using Capacity Planning, take a look at this guide:

How to Use Capacity Planning in Nagios XI

If you’d like a tour of all of the Enterprise Edition features, this article provides a comprehensive overview:

10 Great Features of the Nagios XI Enterprise Edition

If you’d like to try Capacity Planning out for yourself, we offer a free trial version you can take for a spin:

Nagios XI Free Trial Download

We’d also be happy to offer you a custom Demo session if want a guided tour of our solutions, or a free Quickstart remote session with a sales engineer to help you get a few things set up. You can email sales@nagios.com for details on setting up either option.

Reports can be viewed, exported as various file types, and emailed in the Standard Edition of XI. Reports can be scheduled for automatic delivery in the Enterprise Edition. In this article, we’ll take a look at each report to give you an idea of the value each provides. To learn more about all of the various settings available to help you narrow down and fine-tune what your reports display, you can take a look at this document:

Generating Reports in Nagios XI

Available Reports

Executive Summary

The Executive Summary report consolidates Availability, Top Alert Producers, the Alert Histogram, and Latest Alerts into a single report, providing an excellent high-level look at the performance of your infrastructure.

Availability

This report provides pie charts indicating the percentage of the chosen time period that your selected hosts, services, or groups were working or in problem states such as Warning, Critical, and Unreachable.

SLA

The SLA report is an Enterprise Edition feature that provides an easy way to verify whether you’ve met your SLA targets for monitored objects and groups. Simply choose the whens and whats to get results:

State History

State History provides a detailed, change-by-change look at issues and recoveries over time.

Top Alert Producers

Gain insight into which hosts and services had the most issues during the selected time period with Top Alert Producers.

Alert Histogram

Alert Histogram provides a compact graph of the number of alerts over time.

Notifications

The Notifications report provides a list of all notifications sent by Nagios XI for the selected objects over the selected time period.

Event Log

The Event Log lists Nagios Core engine events, including alerts and retention data auto-saves (the function of Core that saves current state history in the retention.dat file so that if the Core engine is restarted, the state can be referenced as the last known state).

Bandwidth Usage

The Bandwidth Usage report shows daily, weekly, monthly, and annual traffic graphs for each interface you monitor with the Network Switch/Router wizard, along with In/Out/Max/Sum data in a table at the bottom.

Capacity Planning

This Enterprise Edition feature enables you to project future usage based on the historical performance data you’ve collected to help you stay ahead of resource overload and roll out upgrades before they impact your key business processes.

Network Report

This report provides chord diagrams showing top talkers in your network, based on flow data collected by Nagios Network Analyzer. It’s quick and easy to integrate Network Analyzer with XI, and these reports begin to provide data as soon as the two tools are linked.

Network Query

The second Network Analyzer report available in XI, Network Query puts all of the queries you’ve created in Network Analyzer at your fingertips:

Data Visualizations

Alert Heatmap

The Alert Heatmap provides a visually striking perspective on the intensity of alerts over time.

Alert Stream

This handy stream graph provides a visual representation of the quantity of alerts over time:

Alert Timeline

View all of the alerts detected by Nagios over time with the Alert Timeline and click on any of the event dots for further details about the individual event.

Network Replay

Network Replay is a great visualization that combines time with topology, enabling you to play through state changes over time, viewed on the Hypermap network diagram.

Legacy Reports

In this section you’ll find the basic legacy Nagios Core reports, in case you’d like to view them inside of Nagios XI.

Audit Log

The Audit Log is also worth a mention, providing details on the usage and functions of your XI system. This Enterprise Edition report can be filtered by User Interface, Core Config Manager, Subsystem, API, Core, and Other for quick access to specific subsets of audit data. For example, filtering by User Interface will show you when users accessed the web UI:

Graphs

Although performance graphs do make an appearance in regular reports such as Bandwidth Usage, Nagios XI has an array of additional graphing tools built in. To learn more about those, you can take a look at this article:

Use Nagios XI Graphs to Illuminate Your Infrastructure

Getting Started

If you’d like to try out all of the reports yourself, you can take the free 30-day trial for a spin:

Nagios XI Free Trial Downloads

If you need a hand during your trial, we have a variety of resources available. Email us at sales@nagios.com, and we’d be happy to assist you.

Home > Performance Graphs

First, let’s look at the regular Performance Graphs. Here you can easily view graphs of the individual services on a single host, the ping checks on all of the hosts in a hostgroup, or all of the services in a servicegroup. At the top of the menu, you’ll see the Time Period and object selection settings.

To the right of each graph, you’ll see a hamburger menu you can click to choose an export option, and buttons to view the raw data, or view the object status, notifications, and history.

Exploring the Graph Explorer

This powerful tool can be found at Home > Graphs > Graph Explorer.

• Top Alerts, Host Health, Service Health

The options begin humbly in the first three tabs with a simple bar chart showing Top Alerts, a Host Health pie chart, and a Service Health pie chart. Of important note is the Dashify icon, which you’ll notice throughout the XI interface. Simply click it to add whichever visualization you see above to a Dashboard:

• Scalable Performance Graph

This simple tool provides a way to quickly create a graph for a single service, for a set period of time.

• Time Stacked Performance Graphs

Time Stacked graphs have tremendous value, providing you with an easy way to stack resource usage of a service over chunks of time on a single graph. This enables you to quickly spot certain times of the day or week that usage tends to be high, as well as anomalies to investigate further.

• Multistacked Performance Graphs

Multistacked graphing is one of the most powerful graphing features in Nagios XI, enabling you to combine any and as many services as you’d like onto a single graph for quick comparison and insight into the performance of many objects at once. One example of its use would be to visualize memory usage on several hosts in one place. Also note the Graph Options dropdown at the bottom of the graph options, which enables you to choose between area stacked (as shown below), area, line, and spline Line Type:

Metrics

Metrics is an excellent tool and is often overlooked. It provides a way to visualize current and historical performance filtered by categories, including Disk Usage, CPU Usage, Memory Usage, Load, and Swap.

Though not a graph, the Gauges tab is worth a mention, providing compact bar dashlets representing the percent usage of services, including colored lines representing their warning and critical thresholds:

Capacity Planning

Capacity planning is an Enterprise Edition favorite that enables you to project future usage based on the historical performance data collected by Nagios XI. Using this tool, you’ll be able to get ahead of resource overload by allocating additional storage and power to your machines before they need it.

Network Analyzer Traffic Analysis Tab

If you’re using Nagios Network Analyzer alongside XI for flow analysis, you’ll also notice an extra tab in your Host Detail pages labelled Network Traffic Analysis that will help you visualize what IPs the host is communicating with in a sharp-looking chord diagram.

Monitoring Engine Event Queue

This handy graph, found at Home >Monitoring Process > Process Info, provides insight into how busy the Nagios Core engine is currently, and over the upcoming 5 minutes.

To learn more about monitoring your monitoring servers, take a look at this article:

Monitor of Monitors: Easily Monitoring Nagios Servers

The Law of Averages

By default, Nagios XI will store your performance data in a Round Robyn Database for four years. The most recent data has the most granularity, while older data is averaged. This function significantly reduces the storage required to house your historical performance data. The general schedule as data ages is:

• 0 to 48 hours: 1-minute increments

• 48 hours to 10 days: 5-minute average

• 11 to 90 days: 30-minute average

• 92 days to 4 years: 6-hour average

If you’d like to dig further into the RRD file averaging function, this Knowledgebase article is a great resource:

Nagios XI: Performance Data Averaging

To learn more about using and managing graphs in Nagios XI, you can review this document:

Generating Graphs with Nagios XI 2024

And, if you aren’t using Nagios XI yet and would like to try out all of the features, you can find the free, fully functional trial here:

Nagios XI Free Trial Downloads

Audit Log

The Audit Log provides easy access to details on interactions with the user interface, Core Config Manager, subsystems, API, Core engine, and other elements of the Nagios XI application. Results can be filtered by time, source, type, and user, and downloaded as a CSV or PDF file. You’ll also notice a Send to Nagios Log Server button, which makes forwarding these logs upstream to your Log Server setup a breeze.

BPI

Although BPI (Business Process Intelligence) is included in the Standard Edition, the Enterprise Edition adds the ability to automatically sync your hostgroups and servicegroups into BPI groups, providing a way to get further value out of time spent carefully cultivating your groups.

To learn more about using BPI, you can review the Using BPI guide.

You can find a detailed cluster monitoring with BPI use-case example here.

Bulk Modification and Bulk Renaming

The Bulk Modifications Tool has long been a favorite of Enterprise Edition users, especially those with large and dynamic environments. The tool enables you to quickly modify a key setting on as many hosts or services as you’d like with a few clicks.

Bulk Renaming not only provides a way to rename many objects at once, but even better (unlike renaming one-at-a-time in the Core Config Manager) ensures that your historical performance data is retained even after changing the name of an object.

Capacity Planning

Capacity Planning is another user favorite. This Enterprise Edition feature enables you to project future resource usage based on collected historical performance data. The projections can be viewed in graphs, added to dashboards, made into reports, and even monitored using the Capacity Planning Wizard. This will empower you to run maintenance on and allocate additional resources to your equipment before it becomes overloaded.

You can learn more about using Capacity Planning in Nagios XI 2024 here:

Deadpool

In dynamic environments, the Deadpool can be a major timesaver. This feature provides a way to automatically decommission hosts and services that have been in a problem state for a customizable amount of time. Stage 1 automatically stops notifications, then Stage 2 can be set to either delete (remove entirely) or deactivate (mark ‘inactive’, thus stopping the Core engine from monitoring but leaving the config in the Core Config Manager).

Full details on using the Deadpool can be found here.

Scheduled Pages and Reports

The Standard Edition already provides a lot of value by making emailing and downloading individual reports quick and easy, but have you ever dreamed of automating report delivery? With Scheduled Pages and Reports, you’ll be able to accomplish this with ease, setting XI to send key reports to teams and managers on whichever frequency you choose.

You can learn more about page and report scheduling options here.

SLA Report

Speaking of reports, the SLA Report is another great Enterprise Edition feature. Simply choose the time period to report on, narrow down the results to the specific hosts, services, or groups, and enter your SLA target for immediate insight into SLA status.

Full details on using the SLA Report can be found here.

Notification Management

For admins with large teams, the Notification Management feature can be a big timesaver. This tool provides a way to template notification messages, preferences, and time periods, then deploy them to many users at once.

SNMP Trap Interface (NXTI)

SNMP Traps are a powerful way to passively monitor a broad array of devices and applications, but can be challenging to integrate into your monitoring, especially from the command line. NXTI provides a GUI-driven option to help you leverage SNMP Traps with Nagios XI.

NXTI provides the following capabilities:

• View, Add, Edit, Copy, Delete, and Disable trap definitions.
• View and Delete received trap logs.
• Search and sort both trap definitions and received trap logs.
• Monitor the snmptt process.
• Locally test snmptrapd/snmptt functionality.

More details on NXTI’s capabilities, along with technical documentation links, can be found here:

Accessing Enterprise

The Enterprise Edition features directory can be found by simply clicking the Enterprise main menu in Nagios XI.

If you’re currently running the Standard Edition and would like to upgrade, simply email sales@nagios.com so our team can assist you. Once your license is upgraded, you’ll be able to add an additional key in the Admin > License Information menu to immediately activate the Enterprise features.

Capacity Planning within Nagios XI requires Nagios XI 2012 Enterprise Edition or greater, any previous version of Nagios XI will not have the Capacity Planning capabilities.

Nagios XI 2024 & 2026

How to Use Capacity Planning in XI 2026

Nagios XI 5.x (Legacy) 

How to Use Capacity Planning in XI 5