Ah, I see what you are saying. So in this case we wouldn't display the 10,000 clients individually, but would roll up that traffic in an "Other" category if the top 10 talkers didn't equate to 95% of the total traffic. Additionally, in the Netflow Device Metric report, we will display the top 20 talkers for the device(s), and then the top 10 per interface. Would this get you closer?
On another note, I am curious what the use case is for being able to see such a large number of small connections, is this purely to understand what comprises a traffic spike or for something deeper?
