An anomaly is not simply a high bandwidth value. It is a meaningful deviation from expected behavior that must be evaluated in context.
Build a useful baseline
Compare like-for-like periods and retain separate expectations for inbound and outbound traffic, subnet groups, services and packet rate. A normal value for one part of the network may be exceptional for another.
Use Mbps and PPS together
Throughput describes transferred volume while packets per second can reveal floods, scanning or small-packet behavior that bandwidth alone may hide. Reviewing both metrics reduces misleading conclusions.
Preserve event context
Record the affected IP or subnet, direction, trigger, start and end time, peak values and current status. This turns an alert into an investigation record that can be compared with historical behavior.
Validate before action
Correlate the event with top talkers, protocols, security signals and routing state. Flowtrion uses this shared evidence to help teams prioritize real impact and reduce false positives.