The actual implementation of the flow monitor already allows a basic aggregation of multiple streams ("flows") between same IP's and services into a single log line. But there are often still multiple loglines for same applications (for example for YOUTUBE) for a single User due different IP's (or Ports).
a) For better readability in bigger enviroments a further "full aggregation" may be more optimal, if all similar applications would be logged into one single log line (All "YOUTUBE" lines aggregated into one line), which gives a better overview of real overall network usage and also would allow listing of more different applications in the flow monitor
b) If this full aggregation would show for example instead the destination and source IP adresses (if there are multiple IP's) a hyperlinked placeholder as "7 IP's" instead, which could be clicked and then opens a Detailview for this Application listing all streams and IP's for the selected application in the separate Window.
Beside of that the new flow monitor is really cooool [:D]
