Methods and apparatuses enable a traffic analyzer to monitor an internal connection of a computing system for one or more traffic patterns. The traffic analyzer compares traffic on the internal connection to an expected traffic pattern, and performs a policy based action based on the result of comparing the traffic pattern to the expected pattern. The traffic analyzer can exist in a stack of a VMM or a monitoring VM or be implemented in a management engine of the computing system. In one embodiment, the computing system includes traffic analyzer components in both a VMM or monitoring VM and a management engine.