Flow aggregation (by source ip)