A network device includes one or more communication ports, a packet processing circuit and an activity evaluation circuit. The one or more communication ports are configured to communicate packets over a network. The packet processing circuit is configured to process the packets. The activity evaluation circuit is configured to generate a sequence of multiple evaluation times independently of the packets, and, for each evaluation time among at least some of the evaluation times in the sequence, for any packet that is processed by the packet processing circuit at the evaluation time, to identify a session to which the packet belongs and issue an increment event associated with the identified session.