DDoS Detection with netflow?