Incident response can range from spotting Napster jams to identifying users who have tried to attack or compromise a campus machine or server. We could search for all traffic from host O and notify sites of possible break-ins. Based on the traffic reports, a school can choose to add bandwidth to the overall network or to a particular part of the network. Also, if a specific function, like a news server, was taking up bandwidth that couldn't be supported by the network, the IT organization could choose to discontinue the service. This is also called performance or capacity planning.
Firewalls are network blocks that restrict access to or from part of the network.
Also, if internal users are accessing problematic external sites such as Napster, a school can choose to block access from the network. In usage billing, each department is charged based on usage to help support the cost of running the network. John Ladwig, the former security architect at the University of Minnesota, says Minnesota uses the logs to monitor an Internet pipe that is shared with a neighboring organization. If there is significant change in the usage ratio, the costs can be accounted for. An engineer enables the router to log data and programs it to send the results to a server once the day is done.