Patent ID: 7941527

Claim:
A method, comprising: monitoring, by a network node, a plurality of flows in a computer network for a monitoring period, each flow of the plurality flows being open for a length of time until ending by one of either a distinct ending or by being silent longer than a configured aging timer thereby ending by aging, wherein a flow is considered a zombie flow if the flow is open but will not receive any more packets and will eventually be silent longer than the configured aging timer and thereby end by aging; in response to each flow, of the plurality of flows, that is ending, increasing a total flow time value by a length of time that the flow was open; in response to each flow, of the plurality of flows, that is ending by aging, increasing a zombie flow time value by the aging timer; and estimating, after the monitoring period, a ratio of zombie flows to the plurality of flows at a time in the computer network as the zombie flow time value divided by the total flow time value.