A network of computing devices (100/450) arranged to handle network flows for extracting statistical information for protecting the network of computing devices (100/450) against suspect traffic or emerging security threats; the network of computing devices (100/450) comprising a first computing device comprising: a first media access controller, MAC; a second MAC; and processing hardware configured to provide passthrough transmission of packets of network flows by transmitting, from the first MAC, packets as received by the second MAC, and/or by transmitting, from the second MAC, packets as received by the first MAC, while the packets are passing between the first MAC and the second MAC, access a same partition of each of the packets; compute first local statistical summary information (196/198) of whatever arbitrary contents are in the accessed same partitions by applying a hash function to the arbitrary contents in the accessed same partitions to compute a hash of each one of the arbitrary contents in the accessed same partitions; maintain counts of the computed hashes, wherein each count of the computed hashes corresponds to the number of times that the same hash was computed by the first computing device; and at different times, transmit (163, 271) the first statistical local summary information via the network to a second computing device that is configured to compute a global statistical summary from the first local statistical summary information and from a second local statistical summary information computed by a third computing device; the second local statistical summary information having been computed by the third computing device by providing passthrough transmission of other packets, accessing a same partition of each of the other packets, and computing the second local statistical summary information by applying the hash function to arbitrary contents in the accessed same partitions to compute a hash of each of the arbitrary contents in the accessed same partitions and maintain counts of the computed hashes, wherein each count of the computed hashes corresponds to the number of times that the same hash was computed by the third computing device; wherein each of the first and second local statistical summary information further comprising the top-N counts of the most frequently computed hashes at the corresponding time thereof, as well as the top-N computed hashes of the respectively corresponding top-N counts. a first media access controller, MAC; a second MAC; and processing hardware configured to provide passthrough transmission of packets of network flows by transmitting, from the first MAC, packets as received by the second MAC, and/or by transmitting, from the second MAC, packets as received by the first MAC, while the packets are passing between the first MAC and the second MAC, access a same partition of each of the packets; compute first local statistical summary information (196/198) of whatever arbitrary contents are in the accessed same partitions by applying a hash function to the arbitrary contents in the accessed same partitions to compute a hash of each one of the arbitrary contents in the accessed same partitions; maintain counts of the computed hashes, wherein each count of the computed hashes corresponds to the number of times that the same hash was computed by the first computing device; and at different times, transmit (163, 271) the first statistical local summary information via the network to a second computing device that is configured to compute a global statistical summary from the first local statistical summary information and from a second local statistical summary information computed by a third computing device; the second local statistical summary information having been computed by the third computing device by providing passthrough transmission of other packets, accessing a same partition of each of the other packets, and computing the second local statistical summary information by applying the hash function to arbitrary contents in the accessed same partitions to compute a hash of each of the arbitrary contents in the accessed same partitions and maintain counts of the computed hashes, wherein each count of the computed hashes corresponds to the number of times that the same hash was computed by the third computing device; wherein each of the first and second local statistical summary information further comprising the top-N counts of the most frequently computed hashes at the corresponding time thereof, as well as the top-N computed hashes of the respectively corresponding top-N counts. compute first local statistical summary information (196/198) of whatever arbitrary contents are in the accessed same partitions by applying a hash function to the arbitrary contents in the accessed same partitions to compute a hash of each one of the arbitrary contents in the accessed same partitions; maintain counts of the computed hashes, wherein each count of the computed hashes corresponds to the number of times that the same hash was computed by the first computing device; and at different times, transmit (163, 271) the first statistical local summary information