A device for identifying network devices (101, 102, 103) which are located in a network address translation, NAT, based communication network, wherein the device comprises: - an obtaining unit, configured to obtain network traffic sent to or from the NAT based communication network; - an extracting unit, configured to extract identification data from the obtained network traffic; and - a processing unit, configured to perform a first method to determine a first number of network devices in the NAT based communication network and a first confidence value, based on the identification data; perform a second method to determine a second number of network devices in the NAT based communication network and a second confidence value, based on the identification data; and calculate a weighted result based on the first number, the first confidence value, the second number and the second confidence value, wherein the identification data includes a GQUIC user agent identifier, a TCP fingerprint, an SSL fingerprint, or a network traffic classifier, wherein the processing unit is further configured to select the first method from: GQUIC user agent identifier correlation, TCP fingerprinting, SSL fingerprinting, or network traffic classification correlation; and wherein the processing unit is configured to select the second method from: GQUIC user agent identifier correlation, TCP fingerprinting, SSL fingerprinting, or network traffic classification correlation; wherein the first method and the second method are different, wherein the first confidence value is a value indicating the probability of correctness of the first number determined by the first method, and the second confidence value is a value indicating the probability of correctness of the second number determined by the second method. - an obtaining unit, configured to obtain network traffic sent to or from the NAT based communication network; - an extracting unit, configured to extract identification data from the obtained network traffic; and - a processing unit, configured to perform a first method to determine a first number of network devices in the NAT based communication network and a first confidence value, based on the identification data; perform a second method to determine a second number of network devices in the NAT based communication network and a second confidence value, based on the identification data; and calculate a weighted result based on the first number, the first confidence value, the second number and the second confidence value, wherein the identification data includes a GQUIC user agent identifier, a TCP fingerprint, an SSL fingerprint, or a network traffic classifier, wherein the processing unit is further configured to select the first method from: GQUIC user agent identifier correlation, TCP fingerprinting, SSL fingerprinting, or network traffic classification correlation; and wherein the processing unit is configured to select the second method from: GQUIC user agent identifier correlation, TCP fingerprinting, SSL fingerprinting, or network traffic classification correlation; wherein the first method and the second method are different, wherein the first confidence value is a value indicating the probability of correctness of the first number determined by the first method, and the second confidence value is a value indicating the probability of correctness of the second number determined by the second method. perform a first method to determine a first number of network devices in the NAT based communication network and a first confidence value, based on the identification data; perform a second method to determine a second number of network devices in the NAT based communication network and a second confidence value, based on the identification data; and calculate a weighted result based on the first number, the first confidence value, the second number and the second confidence value, wherein the identification data includes a GQUIC user agent identifier, a TCP fingerprint, an SSL fingerprint, or a network traffic classifier, wherein the processing unit is further configured to select the first method from: GQUIC user agent identifier correlation, TCP fingerprinting, SSL fingerprinting, or network traffic classification correlation; and wherein the processing unit is configured to select the second method from: GQUIC user agent identifier correlation, TCP fingerprinting, SSL fingerprinting, or network traffic classification correlation; wherein the first method and the second method are different, wherein the first confidence value is a value indicating the probability of correctness of the first number determined by the first method, and the second confidence value is a value indicating the probability of correctness of the second number determined by the second method.