1. A method, comprising: receiving a network event with a set of event parameters; determining whether the network event belongs to a network session associated with one or more previously received network events; categorizing the incoming event into the same network session as the one or more previously received events; comparing the network event to information representing one or more NAT devices and one or more network address translation rules respectively associated with the NAT devices; associating the network event with a particular NAT rule of one of the NAT devices; estimating one or more other events that are associated with the network event, based on the particular NAT rule; determining whether the one or more other events belong to the same network session.