Depends on the nature of the spikes that are causing slowness. Netflow can give you averages that are relatively close, but if you want to see real per second (even sub-second if you would like) I would suggest spanning your MPLS connection to a box running Argus. I'd be glad to provide details on that route, I'm sure there are other options but I haven't found many that can do sub-second monitoring. If you happen to be able to go to the remote site you can pump the span port into a box running etherape as well, it's a standard install on all the main Linux distros. http://etherape.sourceforge.net/images/v0.9.3.png