A system and method for monitoring user traffic. An observance window is established for a time period associated with the CIR burst refresh rate. Incoming bits are measured to determine if the CIR plus CBS rate is exceeded. A determination is made whether there is a threshold crossing during the observance window. A flag state is set indicating a user device is out of conformance in response to determining there is a threshold crossing.