A SOC analyst is building a network profile to detect anomalies for the corporate LAN. She has already documented total throughput and typical session durations. To complete the profile per common network profiling guidance, she wants to record the set of IP addresses that legitimately generate and receive traffic on the segment. Which network profiling element is she documenting?