Patent ID: 7733805

Claim:
A method of determining activity in a network, comprising: determining a plurality of frame flows in the network whose activity is to be monitored; partitioning, by a processor, a first portion of said plurality of frame flows into a first set and a second portion of said plurality of frame flows into a second set, each frame flow having an associated count value, wherein said first set has associated an equivalent number of hardware counters for counting frame flow activity as there are frame flows in said first set such that all of the frame flows in said first set are counted by hardware counters, and wherein said second set has associated a smaller number of hardware counters for counting frame flow activity than there are frame flows in said second set such that only said smaller number of frame flows are counted by hardware counters, and the difference between said smaller number and the number of frame flows in said second set comprising overflow frame flows that are not counted by hardware counters, wherein the count value for said overflow frame flows is maintained by software; periodically determining frame flow activity for the frame flows having associated hardware counters and updating the associated count values for said frame flows; sorting all frame flows based on count values; assigning frame flows with the highest count values to said first set and configuring the hardware counters as required; and assigning the remaining frame flows to said second set and changing which frame flows of said second set have associated hardware counters and configuring the hardware counters as required so that all frame flows in said second set are periodically associated with hardware counters to determine count values.