The visualization capability provided by VisFlowConnect-IP allows an operator to assess the state of a large and complex network given an overall view of the entire network and filter/drill-down features with a friendly user interface that allows users to request more detailed information of interest such as specific protocol traffic flows. VisFlowConnect-IP uses a compact data structure and efficient algorithms for generating statistics and visual representations thus enabling it to run uninterrupted for long periods and on large data sets. The value of VisFlowConnect-IP specifically for security situational awareness is that any security event, with only a few minor exceptions, will be reflected as a traffic flow.