Going along the deep packet inspection route, it would be nice if this program accounted for the LACP encapsulated frame, and VLAN tags. It would also be cool if the operator could specify what VLAN tags to detect traffic for, to eliminate possible noise.