This disclosure relates a method within a network node and a corresponding network node for determining input information for creation of a data traffic clustering model. The method comprises obtaining data descriptors of data flows, wherein the data descriptors describe data of the data flows, and obtaining flow information of the data flows. In addition, the method comprises determining clustering model input information based on the obtained data descriptors and the obtained flow information. One exemplary advantage of the present disclosure is that it allows traffic clustering based solely on packet header information, making the present disclosure appropriate for handling encrypted traffic.