For whatever it's worth, what you describe above is specifically what IPFIX/NetFlow etc does. Not full-take, just metadata for each flow such as the time, src/

For whatever it's worth, what you describe above is specifically what IPFIX/NetFlow etc does. Not full-take, just metadata for each flow such as the time, src/dst ip/port, tcp sequence #, octets sent, etc. This is common in datacenters for traffic and flow analysis for troubleshooting, capacity planning, and the occasional incident response. More details: https://en.wikipedia.org/wiki/IP_Flow_Information_Export https://en.wikipedia.org/wiki/IP_Flow_Information_Export