A distributed network traffic flow monitoring system, comprising: a plurality of network packet flow collector devices for receiving netflow packets associated with a traffic flow activity data at a network connection, the traffic flow activity data comprising one or more transmissions between particular source and destination IP addresses wherein each of the plurality of network packet flow collector devices maintains a plurality of entries corresponding to individual transmissions observed by each of the plurality of network packet flow collector devices; and a network packet flow coordinator device connected to the plurality of network packet flow collector devices and configured to aggregate probabilistic information related to the traffic flow activity data from the plurality of network packet flow collector devices and configured to estimate cardinality of the traffic flow activity data based on the aggregated probabilistic information, wherein the network packet flow coordinator device is further configured to estimate cardinality of the traffic flow activity data by applying a HyperLogLog technique to the aggregated plurality of entries using one or more probabilistic counters (502a-502c, 504) and performing a set operation on the one or more probabilistic counters (502a-502c, 504), wherein the network packet flow coordinator device is further configured to detect distributed denial of service and/or port scan network attacks in dependence on the estimated cardinality. a plurality of network packet flow collector devices for receiving netflow packets associated with a traffic flow activity data at a network connection, the traffic flow activity data comprising one or more transmissions between particular source and destination IP addresses wherein each of the plurality of network packet flow collector devices maintains a plurality of entries corresponding to individual transmissions observed by each of the plurality of network packet flow collector devices; and receiving netflow packets associated with a traffic flow activity data at a network connection, the traffic flow activity data comprising one or more transmissions between particular source and destination IP addresses wherein each of the plurality of network packet flow collector devices maintains a plurality of entries corresponding to individual transmissions observed by each of the plurality of network packet flow collector devices; and a network packet flow coordinator device connected to the plurality of network packet flow collector devices and configured to aggregate probabilistic information related to the traffic flow activity data from the plurality of network packet flow collector devices and configured to estimate cardinality of the traffic flow activity data based on the aggregated probabilistic information, wherein the network packet flow coordinator device is further configured to estimate cardinality of the traffic flow activity data by applying a HyperLogLog technique to the aggregated plurality of entries using one or more probabilistic counters (502a-502c, 504) and performing a set operation on the one or more probabilistic counters (502a-502c, 504), wherein the network packet flow coordinator device is further configured to detect distributed denial of service and/or port scan network attacks in dependence on the estimated cardinality.