Monitoring platforms will happily generate every report they offer, and inboxes will happily ignore most of them. A report earns its existence by answering a recurring question for a named audience on a cadence that matches how the question recurs. This page lays out the core traffic report set organized that way, with the audience and cadence for each, and the small design habits that keep reports read.
In this guide:
- The core report set: operational, capacity, security, and cost.
- Audience and cadence for each, since both decide whether reports get read.
- Design habits that separate read reports from archived ones.
Operational reports: for the people running the network
Top talkers and top applications, daily or on demand. The first question in nearly every investigation is who and what consumed the link. A standing daily view per critical interface makes the answer ambient knowledge rather than a query, and the on-demand version anchors incident review.
Interface utilization summary, weekly. Peak and 95th percentile utilization per monitored link, against capacity. The 95th percentile matters because it is the industry's standard way to describe sustained load while discarding momentary spikes, and it is the figure carriers themselves bill on in burstable arrangements.
Traffic anomaly digest, daily for security review. Baseline deviations, first-seen destinations, and threshold events from the last 24 hours, tiered by severity, feeding whoever owns the security review habit.
Capacity reports: for the people planning spend
Utilization trend per link, monthly. Three or more months of peak and 95th percentile figures per circuit, with growth rate. This single report converts upgrade debates into arithmetic: at the current growth rate, this link crosses sustained saturation in N months.
Application growth report, monthly or quarterly. Which application categories grow, which shrink, and where new demand originates. Capacity problems usually arrive as application adoption before they arrive as utilization, and this report is the early warning.
Security reports: for the people watching for trouble
Unsanctioned destination report, monthly. External services in use outside the sanctioned inventory, ranked by volume and adopting hosts, feeding the shadow IT governance loop covered in our shadow IT detection guide.
East-west summary, monthly. Internal traffic patterns against baseline: fan-out outliers, new internal conversation pairs, and volume shifts between segments. This is the report that notices lateral movement patterns when no alert fired.
Cost reports: for the people paying the bills
Departmental and site usage, monthly. Traffic volume attributed to IP groups representing departments or sites. Where chargeback exists, this is the invoice input; where it does not, it is still the fairest answer to who drives the bandwidth budget.
WAN and interconnect cost efficiency, quarterly. Utilization against cost per circuit, which surfaces both the saturated links needing money and the underused ones wasting it. Downgrades pay for upgrades more often than budgets assume.
Design habits that keep reports read
Three habits separate read reports from archived ones. Lead with the exception: the report's first element names what changed or breached, because a report whose first page is a stable graph teaches its audience to stop opening it. Match cadence to decision cycles: capacity reports monthly because budgets move monthly, anomaly digests daily because response moves daily. And prune annually: any report nobody references for two cycles gets retired, on the same logic that governs alerts. Generation is free, attention is the scarce input, and the report set should be curated for the attention it actually receives.
Reporting with ManageEngine NetFlow Analyzer
ManageEngine NetFlow Analyzer ships the report set above through a built-in library and a custom report builder, on schedules, to the audiences named.
Feature highlights:
- Report library: Top talkers, application, utilization, and trend reports as standing configurations.
- Custom report builder: Audience-specific reports from any combination of interfaces, groups, and time ranges.
- Scheduling and delivery: Automated generation to email and archive, matched to each audience's cadence.
- Departmental attribution: IP group reporting for chargeback and budget conversations.
FAQs on traffic reports
What is a 95th percentile utilization figure?
Sort an interval's utilization samples and discard the top 5 percent; the highest remaining value is the 95th percentile. It describes sustained load while excluding momentary spikes, and it is the standard basis for burstable bandwidth billing, which makes it the right figure for capacity decisions.