A computer-implemented method comprising: receiving virtualized traffic at a first ingress port of a first network visibility appliance (700b, 802a), wherein virtualized traffic is traffic sent by at least one virtual machine (402a, 402b); separating the virtualized traffic into a first batch of data packets that share a first characteristic in common, the first batch to be examined by a first instance of a deduplication program (706b, 804a) that executes in the first network visibility appliance (700b, 802a), and a second batch of data packets that share a second characteristic in common, the second batch to be examined by a second instance of the deduplication program that executes in a second network visibility appliance; receiving a third batch of data packets at a second ingress port of the first network visibility appliance (700b, 802a); determining that all data packets in the third batch share the first characteristic in common; forwarding all data packets of the first batch and all data packets of the third batch to the first instance of the deduplication program (706b, 804a) that executes in the first network visibility appliance (700b, 802a) for examination; forwarding all data packets of the second batch to an egress port for transmission to the second network visibility appliance, for examination by the second instance of the deduplication program that executes in the second network visibility appliance; and forwarding at least a portion of the first batch of data packets from the first network visibility appliance (700b, 802a) to a network tool (410, 806a, 806b, 806c) that is coupled to the first network visibility appliance (700b, 802a) via a tool port, after deduplication of the first batch of data packets by the first instance of the deduplication program (706b, 804a). receiving virtualized traffic at a first ingress port of a first network visibility appliance (700b, 802a), wherein virtualized traffic is traffic sent by at least one virtual machine (402a, 402b); separating the virtualized traffic into a first batch of data packets that share a first characteristic in common, the first batch to be examined by a first instance of a deduplication program (706b, 804a) that executes in the first network visibility appliance (700b, 802a), and a second batch of data packets that share a second characteristic in common, the second batch to be examined by a second instance of the deduplication program that executes in a second network visibility appliance; a first batch of data packets that share a first characteristic in common, the first batch to be examined by a first instance of a deduplication program (706b, 804a) that executes in the first network visibility appliance (700b, 802a), and a second batch of data packets that share a second characteristic in common, the second batch to be examined by a second instance of the deduplication program that executes in a second network visibility appliance; receiving a third batch of data packets at a second ingress port of the first network visibility appliance (700b, 802a); determining that all data packets in the third batch share the first characteristic in common; forwarding all data packets of the first batch and all data packets of the third batch to the first instance of the deduplication program (706b, 804a) that executes in the first network visibility appliance (700b, 802a) for examination; forwarding all data packets of the second batch to an egress port for transmission to the second network visibility appliance, for examination by the second instance of the deduplication program that executes in the second network visibility appliance; and forwarding at least a portion of the first batch of data packets from the first network visibility appliance (700b, 802a) to a network tool (410, 806a, 806b, 806c) that is coupled to the first network visibility appliance (700b, 802a) via a tool port, after deduplication of the first batch of data packets by the first instance of the deduplication program (706b, 804a).