Patent ID: 8400933

Claim:
A computer-implemented method of monitoring a network, comprising: at each node of a fixed set, the computer constructing a corresponding vector of M components based on data packets received at the node during a time period, M being an integer greater than 1, the fixed set being formed of some nodes of the network; and based on the constructed vectors, the computer estimating at least one of: (a) how many of the received data packets have been received by all of the nodes of the set and (b) how many flows of the received data packets have data packets that have passed through all of the nodes of the set; wherein: the constructing includes updating a component of the vector of one of the nodes in response to the one of the nodes receiving a data packet, the updating including selecting the component for updating by hashing a property of the data packet received by the one of the nodes; and the hashing includes (i) mapping the property of the received data packet to a first element of a first hash function having a set of first elements and (ii) mapping the property of the received data packet to a second element of a second hash function having a set of second elements, wherein the property of the received data packet is a hash key used for both the first hash function and the second hash function.