article entitled "Detecting Worms and
Abnormal Activities with NetFlow".
You'll hear me harp about
this over and over if you follow this blog: if you're responsible for a
network, you need to know what "normal" "looks" like so that you can
recognize "abnormal". This is a good tool to have.