I wrote an algorithm that could detect top talker trends from network flows. At the time it could reliably work up to 40Gbps depending on flow sample rate and your definition of reliable.

Not sure if it's in use anymore.