One of the few things I liked about NTOP was the ability to list all of your internal subnets and then categorize conversations on whether both source and destination were in that internal list or not.  Essentially you could see what traffic was going outside of your network.  I think this needs to be an option.  I'm evaluating NFA for the billing function, but I need to exclude traffic from our hosting customers to our monitoring and backup servers; all I'm concerned about is their bandwidth to the internet.