A method includes receiving, by a distribution server, a plurality of network traffic records. The distribution server generates a first hash from a first plurality of fields in a first of the plurality of network traffic records and generating a second hash from a second plurality of fields in a second of the plurality of network traffic records. The distribution server determines that the first and second of the plurality of network traffic records relate to a session. The method includes transmitting the first and second of the plurality of network traffic records to one of a plurality of worker computing devices selected based on the determination and on at least one of the first and second hash. The distribution server transmits a request for an enumeration of addresses ranked according to a criterion, receives partial enumerations from a plurality of worker computers, and generates a combined, deduplicated enumeration.