Bandwidth monitoring measures how much of a link’s capacity is in use, port by port, over time. A monitoring server reads the interface counters a network device already maintains, converts the change between two readings into a throughput rate, and compares that rate against the thresholds you defined. The result is a number per port you can alert on and graph, which tells you a link is filling up and when.

• Saturation is invisible to a reachability check. A port that is Up and passing traffic at capacity answers a ping normally.
• Upgrade decisions need a record. A year of per-port throughput turns a circuit upgrade request into an argument with evidence behind it.
• Slow is harder to diagnose than down. Knowing which port filled up narrows the search before anyone opens a ticket with the carrier.
• Ports fail quietly. A port that drops from gigabit to 100 megabit after a cable fault keeps working, badly, until throughput data shows the ceiling moved.
• One console covers the network. Port throughput, port status, device reachability, and the servers behind the network run as Host and Service checks in the same interface.

Port Bandwidth and Throughput Monitoring

The Network Switch/Router Wizard scans a device for its interfaces and configures throughput and port status checks against the ports you select.

• Per-port thresholds: Set a default unit and default Warning and Critical thresholds in Step 1, then adjust them per port in Step 2 where a port needs different limits.
• Interface discovery: The wizard scans the device and lists its ports with a Status column showing whether each is administratively up or down, so you monitor the ports that carry traffic rather than every port on a 48-port switch.
• Selective monitoring: Checkboxes in the Throughput and Port Status column decide which of the two metrics is created for each port.
• Bulk configuration: Paste a CSV into the Bulk Configuration section of Step 1 to apply the same port speed and thresholds across many devices.
• Additive re-runs: Re-run the wizard against the same IP address using the same Host Name to rescan for ports, add ports you skipped, or change thresholds on ports already monitored.

Two versions of the wizard ship with Nagios XI. The updated wizard, available in Nagios XI 2026R1.4 and later, uses a plugin written in C, performs far fewer SNMP walks against the target device, and produces throughput checks that are compatible with Nagios Mod-Gearman (NMG) workers. The Legacy wizard remains available; its checks are not compatible with NMG, so if you run Mod-Gearman, your distribution settings must keep those checks on the Nagios XI server.

Documentation: Using the Network Switch/Router Wizard in Nagios XI 2026 | Using the Network Switch/Router Wizard (Legacy)

SNMP Bandwidth Monitoring for Any Device

Where a device is not a switch or router, or exposes a counter the Network Switch/Router Wizard does not collect, the SNMP Wizard polls an Object Identifier (OID) directly.

• Arbitrary OID polling: Supply the OID, a Display Name, a Data Label, Warning and Critical thresholds, and the Management Information Base (MIB) to use for each check.
• SNMP v1, v2c, and v3: Version selection changes the credential fields the wizard presents, so v3 authentication and privacy settings are entered in the wizard.
• Counter discovery: The SNMP Walk Wizard and Walk Jobs tool scan a device to reveal which objects it exposes, so you can see what is available before committing to a check. Limit the scan by MIB or by a starting OID to keep the results manageable.
• Interface errors and discards: These counters sit outside the Network Switch/Router Wizard. Poll them with the SNMP Wizard using the relevant interface MIB OIDs.

Documentation: How To Monitor SNMP OIDs with Nagios XI | Using The SNMP Walk Wizard and Walk Jobs Tool

Bandwidth Usage Reports and Historical Trends

Once a device is monitored, Reports > Bandwidth Usage Report holds daily, weekly, monthly, and annual bandwidth usage graphs, plus daily numerical totals for each port.

• Long-range comparison: Read this month against the same month last year to separate a growth trend from a one-week anomaly.
• Per-port totals: Daily numerical totals per port give you a figure to put in a capacity request rather than a screenshot of a graph.
• Scheduled delivery: Send reports to stakeholders on a schedule instead of exporting them by hand each month.
• Capacity Planning: The Capacity Planning component projects resource trends forward and requires a Nagios XI Enterprise Edition license.

Bandwidth Thresholds and Alerting

A bandwidth check returns a throughput figure, and Nagios XI compares it against the Warning and Critical thresholds you supplied for that port. Nothing is inferred; the state changes because a number crossed a line you drew.

• Per-port limits: A 10-gigabit uplink and a 1-gigabit access port get different thresholds in the same wizard run.
• Port status alongside throughput: Monitor whether a port is Up or Down as a separate Service from its throughput, so a link failure and a saturated link are distinct alerts.
• Notification control: Wizard steps set the check interval, notification conditions, and contacts for the Host and Services created.
• Escalations and dependencies: Route a Critical uplink differently from a Warning on an access port, and suppress downstream noise when the parent device is Down.

SNMP Access and Credentials

• Version selection: SNMP v3 supplies authentication and privacy; v1 and v2c send a community string in clear text.
• Community strings: Do not use the default community string public. Create a dedicated string for monitoring.
• Credential handling: Store community strings and v3 credentials as User Macros so they are referenced rather than repeated across check definitions.
• Character limits: Nagios XI restricts some characters in the SNMP Community and Password fields, so generate credentials with that in mind.

You find the port, not just the outage. When an application slows down, per-port throughput narrows the question from “the network is slow” to a named port on a named device, which is where the fix actually happens.

Capacity requests carry evidence. A year of per-port graphs and daily totals is what turns a circuit upgrade from a preference into a documented trend.

One console instead of a vendor console per device. SNMP polling covers switches, routers, firewalls, and load balancers from any manufacturer that exposes the counters, so port throughput sits next to network switch and router monitoring and the Host checks for the servers behind them.

Degradation surfaces before it becomes a ticket. A Warning threshold at 70 percent of link capacity gives you weeks of notice; a Critical threshold at 90 percent gives you hours.

Adding devices gets faster, not slower. The Bulk Configuration CSV and the additive property of the wizards mean the tenth switch takes less work than the first.

• SNMP enabled on the device. The switch, router, or firewall must have an SNMP agent turned on and be configured to answer queries from the Nagios XI server’s IP address.
• UDP 161 reachable. SNMP polling uses UDP port 161 by default. Open it from the Nagios XI server to each monitored device through any firewall between them.
• Credentials for the version you use. A community string for v1 or v2c, or a v3 username with the matching authentication and privacy settings.
• The device address and a Host Name. The IP address or fully qualified domain name to poll, and the friendly name the device will display as in the interface.
• Port speeds, where they are not detected. Thresholds are meaningful only against the correct link speed, so confirm the speed of any port whose ceiling the wizard cannot read.
• Mod-Gearman distribution settings, if applicable. Checks created by the Legacy wizard must run on the Nagios XI server. Use the updated wizard in Nagios XI 2026R1.4 and later where checks need to run on NMG workers.

1. Navigate to Configure > Configuration Wizards and select the Network Switch/Router Wizard. Use the search field to find it.
2. In Step 1, enter the device IP address and a Host Name, then complete the SNMP Settings. The SNMP Version Settings fields change to match the version you select. Set the Default Unit and the default Warning and Critical thresholds that will populate every port.
3. In Step 2, select the ports to monitor. The Status column shows which ports are administratively up or down. Use the Throughput and Port Status checkboxes to choose the metrics per port, and adjust individual thresholds in the Service Configuration column.
4. Review the summary at the top of Step 3, then set the check interval, notification conditions, contacts, and group associations through the remaining steps.
5. Click Finish. Nagios XI creates the Host and Services and begins polling. Follow the View status details for link to confirm the checks are returning data, then open Reports > Bandwidth Usage Report once a day of history has accumulated.

Documentation: Using the Network Switch/Router Wizard in Nagios XI 2026 | Using Auto-Discovery in Nagios XI | How To Monitor Meraki Switches with Nagios XI

Nagios XI answers how much traffic crossed a port and whether that figure is within the limits you set. It reads interface counters, which give a total in each direction and nothing about the composition of that total. That is the right measurement for capacity planning, threshold alerting, and long-range trending.

Interface counters cannot tell you which addresses, ports, or protocols made up the traffic. That question belongs to flow analysis, where a device exports a record per conversation. Nagios Network Analyzer collects NetFlow, sFlow, jFlow, and IPFIX records and ranks the endpoints and ports consuming a link. The two are licensed separately and integrate through an API key and the Nagios Remote Data Processor (NRDP). Use bandwidth monitoring to know a link is full, and flow analysis to know what filled it.

Packet-level inspection, signature-based intrusion detection, and port scanning are separate categories again, and are covered by the Wireshark, Suricata, and Nmap integrations in Nagios Network Analyzer rather than by SNMP polling.

Network Layer

• LAN and WAN monitoring for link availability across sites
• SNMP monitoring for any device exposing an OID you want to watch

Traffic Composition

• Nagios Network Analyzer for NetFlow, sFlow, jFlow, and IPFIX analysis and top talker ranking

Platform

• Nagios XI for Host, Service, application, and database monitoring
• Nagios Fusion for a single view across several monitoring servers

Run the Network Switch/Router Wizard against a single core switch and you will have port throughput, port status, and thresholds on the ports that matter within an afternoon. Add the rest of the network from there, using the Bulk Configuration CSV once the pattern is set. The trial runs 30 days with the full feature set.

Start a free 30-day trial of Nagios XI or request a demo. Questions about Node counts or which edition covers what you need? Email [email protected].