Patent attributes
Provided are systems and methods for network visibility monitoring. In some implementation, provided is an integrated circuit. The integrated circuit may include a large-flow detection logic operable to determine whether a packet is associated with a large packet flow or a small packet flow, a large-flow caching logic operable to store information about packet flows, a sampling logic operable to sample packets, and a unique-flow estimation logic. The integrated circuit may be operable to receive packets from a network during a pre-determined interval, The integrated circuit may further determine an estimate of the number of unique flows represented by the packets, identify large packet flows by identifying packets associated with the large packet flows, store information about the large packet flows, determine packets associated with small packet flows, and sample the packets determined to be associated with the small packet flows to create packet samples.