Abstract: A system for performing flow analysis across a NAT device comprising a first and second monitoring agent; one or more processors; one or more network interfaces for communicating with the first and second monitoring agents; and non-transitory memory comprising instructions. The instructions cause the one or more processors to receive one or more packets from the first and second monitoring agents for an active TCP connection; generate a set of summary information for the packets received from the first and second monitoring agents; create flow records for each set of summary information; identify one or more flow records that correspond to the active TCP connection using IP address and port number information; annotate each identified one or more flow record with a same flow identifier tag; store the annotated one or more flow records in a database; and perform flow analysis for one or more flows using one or more annotated flow records that correspond to the one or more flows.