I may just have to use a content filter. I avoided it because I struggled to find documentation on what data I have access to. The reason we are collecting the data is to try to do flow-based analysis on specific traffic, and I am unsure what metadata is not included. I would need IPs, port, protocol, and flag. My understanding is that I would not have access to TCP flags if I went with NE Content Filter Provider. Is that wrong?