I have a student who wants to turn on Netflow on his WAN links but he has a concern. The WAN is not heavily utilized during the day, file sharing and Citrix traffic are not heavy. However, during the night traffic levels spike due to backup traffic and iSCSI replication. I understand that MARS baselines traffic with Netflow for 7 days and then starts generating anomaly based incidents. My question: what does MARS do for the baseline? Is it an average amount of traffic for the 7 day period? Is it an average based on different time periods during the day?