Could you use this, for instance, to detect an infected Windows host talking to a botnet? Or would that sort of connection info be lost as noise in the presumably large amount of data captured?
NetFlow or VPC Flow Logs (in AWS) would work just as well for this also.