A method and apparatus are provided for aggregating flow records representing network flow. Specifically, flow records may be organized according to whether they are request records, response records associated with the request records, or flow records associated with neither category. A request record may represent a network flow to a particular device of a particular network flow type, for example, network flow to a standard port. The request records and flow records are then aggregated.