A system and method for aggregating IP flows in a telecommunication network is disclosed. A multi-protocol flow representing packets captured from the telecommunications network during a selected time period is displayed on a user interface of a network monitoring system. The multi-protocol flow is highlighted on the user interface display if any session records within the multi-protocol flow do not meet operator-defined criteria. The user interface detects a user's selection of the multi-protocol flow and displays a plurality of protocol-specific flows that are within the multi-protocol flow. The user interface detects the user's selection of one of the protocol-specific flows and displays a plurality of session flows that are within the selected protocol-specific flow. Any session records that do not meet operator-defined criteria are highlighted on the user interface.