Netflow breaking down traffic?

Question

I am trying to find a way to get a good view within the netflow of actually internet base traffic e.g going to www.google.com vs http updates from my wsus server.

using WSUS to maintain windows updates and it sends it updates via http/https depending on how you have it configured, so my www stats on NTA shows over 40%.

I am trying to find a way to break down that 40% of www traffic to show  valid www traffic coming from the wsus server vs actually internet base traffic.

Things I have look at.
IP groupd within NTA settings, this will allow me to create IP groups, but not segment 1 ip out of my existing IP group.

top 5 application customization.

chris.lapoint · Accepted Answer

In the release we're working on, we're providing the ability to define application mappings based on a port, protocol, and source/destination IP address group.   So, you could have an application called WSUS that's separated out from the rest of your WWW traffic.

If you're interested in participating in the beta (only available to customers active on maintenance) or you'd like a demo of this functionality, please send me a private email through Thwack.