It detects attacks on high speed links through real-time NetFlow aggregation and analysis. PR: ports/69011 Submitted by: David Thiel <lx@redundancy.redundancy.org>