It would be useful (since pmacct can see packets) to keep track of tcp sessions and provide session level TCP performance data. This would help with the "is this the applicaton or the network?"