Programming

Often, there is one tool for capturing data, and another for reports, so development of reports does not affect other reports already satisfactory. Each report program can be separately developed. Since raw data can be voluminous, you may also want a digester, which reduces the traffic detail to summary by time period, ip. It might also fold from-ip and to-ip to a single ip and a send/rec field. Folding IPV6 and IPv4 together might be another area of interest. Folding many IP under the same DNS name also presents challenges, especially if there is Internet caching like Akamai diversifying DNS. You might need to deconstruct DNS calls to see what apps asked for that resulted in the IPs you see.