A system and method for monitoring user traffic. An observance window is established for a time period associated with the CIR rate. Incoming bits are measured to determine if the CIR rate plus a CBS rate is exceeded. A determination is made whether there is a threshold crossing during the observance window. A flag state is set indicating a user traffic flow is out of conformance in response to determining there is a threshold crossing.