process in analyzing observed network traffic data from real time or from the application transaction detail data store the analysis process is suitably performed by analysis engine 18 which may be implemented by processor s 23 packet processing module 25 for example in block 38 the traffic is analyzed to determine client server and traffic type or protocol that is determining which u2018 side u2019 of the traffic flow is which and the type of traffic decision block 40 then determines whether the traffic is the type of traffic that would fall into the client server type of relationship if the determination is that the traffic is not of the type then it is either discarded for purposes of statistics or processing relative to client server of interest or handled in an alternative manner for other purposes in block 42 in the alternative if the decision block 40 determination of whether the traffic is the type of traffic that would fall into the client server type of relationship is that it is of that type then in decision block 44 a determination is made whether the traffic is within the client and or server group of interest by for example looking up the server address for this traffic against the known servers that are in the servers of interest e g those specified by the user for monitoring if the determination is that the traffic is not within the client and or server group of interest then it is.