Using BRO for measuring TCP flow bandwidth

[Justin_Azoff]

capstats(included with bro) can do this:

    capstats -I 5 -i eth0 -f 'host a.b.c.d and host e.f.g.h'