US Patent 10536360 Counters for large flow detection

Provided are systems and methods for managing historically large flows in network visibility monitoring. In some implementations, provided is an integrated circuit. The integrated circuit may be operable to receive packet information describing a packet at the cycle of a clock input. The packet may be associated with a packet flow being transmitted across a network. The integrated circuit may further generate keys using information identifying a packet flow provided by the packet information. The integrated circuit may further read values for counters and state information associated with each counter from a memory, using the keys. The integrated circuit may further determine from the state information that the packet flow identified by the packet information is a historically large packet flow. Upon determining that the packet flow is a historically large packet flow, the integrated circuit may further update an entry in a flow memory using the packet information.