What if the edge router is sitting at MaeEast or some other very busy
edge of your network. Knowing traffic patterns to/from the
interconnects is very useful for traffic engineering and neccesary if
the "attack" you want to trace back goes through an interconnect.
I may be wrong, but I was under the impression that flow switching
wasn't up for this and regular IP accounting is completely useless in
this particular case.