Judging from screenshots, RTM does a deeper level of packet inspection than netflow based system (silk&#x2F;flowbat).<p>As Silk&#x2F;Flowbat are based on netflow records, which doesn&#x27;t inspect the traffic passing across the network. It just records surface level information about the traffic.  Source&#x2F;Dest ports and addresses, UDP vs TCP and length and size of the conversation.<p>Deeper packet inspection probably results in rtm being able to inspect less traffic. Though depending on how RTM is written and the network drivers being used and your network size, you still might be able to have this monitor your egress points.