A system and method for monitoring IP flows in a network is disclosed. A plurality of monitor probes are coupled to links in the network, the monitor probes capture data packets from the links and determine protocols in OSI Layers 3, 4, and 5/7 of the packets. A user interface receives user inputs selecting the links and protocols for analysis. A display is coupled to the monitor probes and the user interface. The display and user interface receiving a user selection of links for analysis and display a first protocol analysis to the user, the first protocol analysis display comprising a pie chart representing all OSI Layer 3 protocols captured on the selected links, a pie chart representing all OSI Layer 4 protocols captured on the selected links, and a pie chart representing all OSI Layer 5/7 protocols captured on the selected links.