Client network traffic data and server network traffic data regarding a number of network nodes is collected and then grouped by IP address. The network nodes are divided into logical groupings and the network traffic data is presented in the aggregate for all IP addresses in each logical group. The logical groupings may be further divided by protocol, application, port and/or logical group-to-group. Each logical group can be further generalized as either a set of IP addresses (e.g., a business group) or a specific logical link between one set of IP addresses to another set of IP addresses (e.g., a business group link). Either or both of these “groups” may be divided in further logical sub-groups: for example, by protocol, application, port and in the case of business groups, group-to-group. The logical groups provide facilities for initial problem detection and identification while the logical sub-groups provide facilities for troubleshooting and problem isolation.