A method for determining a heavy distinct hitter (HDH) in a data stream by a data traffic monitor, the data stream comprising a plurality of element-value (e,v) pairs, includes receiving the plurality of (e,v) pairs from the data stream by an HDH module in the data traffic monitor, the HDH module being in communication with a counter block, the counter block comprising a plurality of hash functions, and further comprising a respective pair of distinct counting primitives associated with each hash function of the plurality of hash functions; and adding each of the plurality of (e,v) pairs to one of the distinct counting primitives of the respective pair of distinct counting primitives for each of the plurality of hash functions in the counter block.