check out how awstats does it. the algorithm is basically, for the maximum duration of inactivity in seconds that is considered a end of session look at each source IP and if the next hit is within that range the visit duration is increased by the difference in timestamps, if it is longer than the timeout it is a new session and the duration is reset with that hits timestamp setting the start point. Again, I have to reiterate that without true session accounting these duration stats will be suspect at best even with a simple site -- you are making guesses about inactivity vs sessions. If these numbers mean something to you even after that realization kudos.