How do you expect to catch this with network traffic analysis?