Patent ID: 7609629

Claim:
A network controller comprising: connecting means for connecting to one or more networks, means for monitoring packets flowing through the networks, means for accumulating a first number of packets with same values of a first fieldset that includes any one or more fields of packets obtained by the monitoring means, and accumulating a second number of packets with the same values for a second fieldset which is different from the first fieldset, and means for estimating the characteristics of packets with the same values of a first fieldset based on the second number if the first number exceed a specified threshold, wherein the accumulating means obtains regions to store the accumulated values of the first and second number of packets from hash values of value sets of the fields, respectively, and when the obtained regions are already used to store accumulated values of other item sets, decrements an accumulated value of the other item sets, and uses the obtained regions for accumulating the first and second number of packets when the decremented accumulated value results in 0.