A system for clustering a plurality of select subsequent records of a network trace; said records comprising a time field storing a time stamp; said system being further configured to perform the following steps: - group said records into a sequence of bursts; wherein a difference between said time stamp of two subsequent records within a burst is no more than a predetermined time difference T1; and wherein a difference between said time stamp of two subsequent records of subsequent bursts is equal to or more than said predetermined time difference T1; further characterized in that said system is further configured to perform the following steps: - group said bursts into a sequence of sessions; wherein a difference between said time stamp of two subsequent records belonging to subsequent bursts of a same session is no more than a predetermined time difference T2; and wherein a difference between said time stamp of subsequent records belonging to subsequent bursts of subsequent sessions is equal to or more than said predetermined time difference T2; wherein T2 is greater or equal to T1; and wherein said records further comprise a first meta field storing a value (220, 221, 222) of a first type of meta-information; and wherein said system is further configured to perform the following steps: - splitting (204, 504) a first burst (201, 202) belonging to a first session into sub-bursts according to said value (220, 221, 222) of said first type of meta-information; and - promoting a sub-burst of said sub-bursts to a promoted session if a time difference between said time stamp of a first and last record of said sub-burst is greater than a predetermined time difference T4; and - if by said promoting within said first session a time difference between a last record in a first sub-burst and a first record of a second subsequent sub-burst is greater than said predetermined time difference T2, then splitting said first session thereby obtaining two new subsequent sessions (401, 402). - group said records into a sequence of bursts; wherein a difference between said time stamp of two subsequent records within a burst is no more than a predetermined time difference T1; and wherein a difference between said time stamp of two subsequent records of subsequent bursts is equal to or more than said predetermined time difference T1; - group said bursts into a sequence of sessions; wherein a difference between said time stamp of two subsequent records belonging to subsequent bursts of a same session is no more than a predetermined time difference T2; and wherein a difference between said time stamp of subsequent records belonging to subsequent bursts of subsequent sessions is equal to or more than said predetermined time difference T2; - splitting (204, 504) a first burst (201, 202) belonging to a first session into sub-bursts according to said value (220, 221, 222) of said first type of meta-information; and - promoting a sub-burst of said sub-bursts to a promoted session if a time difference between said time stamp of a first and last record of said sub-burst is greater than a predetermined time difference T4; and - if by said promoting within said first session a time difference between a last record in a first sub-burst and a first record of a second subsequent sub-burst is greater than said predetermined time difference T2, then splitting said first session thereby obtaining two new subsequent sessions (401, 402).