How to detect abnormal flow in imported flow switches?