As a best practice for network security, IT organizations should capture traffic at every location, not just at the network core.

Consider the case of a large enterprise that suffered a security attack at a branch office. The breach spread from the branch office to headquarters. Without a detailed analysis of the traffic in the branch, the IT organization would have been unable to identify the source of the attack and apply the appropriate controls to prevent its spread.