distribution of duration for TCP flows Filter by protocol=TCP. A tcp flow is: 'SrcPt' 'DstPt' 'SrcIPAddr' 'DStIPAddr Take the maximum of the duration! Do it with pandas. Do it with Map/reduce.