An integrated circuit monitors the most active traffic flow rates on a communications network by using a leaky bucket model having a variable fill rate. As a switch receives packets, the packet identifications are sampled. A sampled packet identification is compared to record identifications in a table of identifications. If the sampled and record identifications match, an activity value for the packet identification is increased by an amount inversely proportional to an activity value associated with the record identification. If the sampled and record identifications do not match, the activity value is decreased. Record identifications are removed from the table when the activity value decreases to a specified level. New sampled identifications are added to the table if empty records exist.