Traffic-flow is no good for me, it doesn't give me the names of the interfaces/usernames of the people connected.
However, I have managed to make threshold 99999 and it does seem to count 99998 in tests (I've never seen it use the other one).
I collect my ip accounting data every 5 minutes, store it in a mysql table per router for 30 minutes then aggogate similar connections (IE: sum(same src -> dest)) into a daily table.
If I could have something like Traffic-Flow that gave me usernames/interface names like ip accounting does - I'd be very, very happy.
<- shows the kind of work flow built.
I've written a fully threaded perl daemon that runs through and collects the data 24/7