An example embodiment of the present invention provides a process that uses IP flow information to selectively notify users of an application server of the server's unavailability. In the example embodiment, the process, which might run on a system comprising a router, monitors IP flow records as to dropped packets and learns that an application server has become unavailable. The process then uses the IP flow records to identify active users of the application server, for example, by passing a source IP address to a presence service. Once the process has identified an active user, the process determines a means of notification for the user, which might be through the presence service, and transmits a notification to the user as to the unavailability of the application server. In the example embodiment, the process transmits a later notification as to the availability of the application server, using reverse camp-on functionality.