A security analyst is building a network profile for the corporate environment to help detect anomalous behavior. The analyst has already documented which TCP and UDP ports are typically open and which internal hosts communicate with which external destinations. According to NIST guidance on network profiling, which additional element should the analyst capture to establish a baseline of how much data normally flows across the network segment over time?