I have noticed that when there is a large file transfer going across the WAN, there seems to be quite a delay before NetFlow detects it. And once it finally appears in NetFlow, it appears that the file transfer only lasted for a few minutes, even-though it could still be ongoing. I'm uncertain if this is more of an issue with at the devices are sending to NPM....or if NPM can be tweaked to read the results "better". But this has been our dilemma. Thanks!