Users report intermittent slowness on the corporate WAN link during business hours. The network administrator wants to identify which hosts and applications are consuming the most bandwidth over time, including source/destination IPs, ports, and byte counts per conversation. Which monitoring data source should the administrator use?