looking for ideas...

[poncenby smythe]

List,

Does anyone know how to get the top 10 or just top IP which initiates 
the most meaningful* connections?

By meaningful I mean flows that can be programmatically determined to be 
human/scheduled events with reasonable payloads and meaning, aiming to 
eliminate the IPs which repeatedly scan and could conceivably be the top 
flow initiator.

Hope it makes sense,

poncenby