I have a similar question about the Network Activity ACC for Source and Destination Activity sorted by "Bytes". The problem I have with these views is they seem to be showing sessions that were still open during the "Time" filter as opposed to having been created during the specified time. Let's say we selected "Last Hour". In my experience we may see the Source IP Activity ACC wiget show a source at the top of the list with a large byte count for 1 session that was open for months (and was still open in the "Last Hour". I asked it to show me stuff going on the last hour, not a session that opened months ago. Is this not what we should expect?
... View more