Hi Everyone, Following up previous email: I think the line below Flow 100 tcp 192.168.1.0 * * * 200 86400 0 should be Flow 100 tcp 192.168.1.0/24 * * * 200 86400 0 at least now it seems to aggregate better! Thanks, John Hermes jhermes at infoglobe.com