workload characterization: priorities coral/ocXmons up to OC12 (OC48) persistent, real-time, full-frame collection dynamic packet filtering triggered by attack precursors security policy compliance auditing (passive) enforcement (active) obstacles hardware expensive privacy issues IPsec