Cisco's flow-export has this information, and cflowd keeps some tables on it. See:
http://engr.ans.net/cflowd
Daniel