Methods and apparatus are provided for determining traffic characteristics and statistics for storage area network flows. An intelligent line card associated with a fibre channel switch is used to snoop selected flows in a storage area network. Flows are characterized using information that may include initiator target pairs and initiator target logical unit number (LUN) groupings. Selected flows are configured for monitoring and information about the selected flows is maintained. Selected flow information can be analyzed at a line card associated with a fibre channel switch.