There are disclosed an apparatus, a machine readable media, and methods for testing a network. The apparatus may include a statistics engine coupled to a memory. The statistics engine may extract a packet group identifier (PGID) from a packet received from the network and retrieve traffic statistics associated with the PGID from the memory. The retrieved traffic statistics may include a packets-per-interval count and a packets-per-interval threshold, the packets-per-interval count indicating a number of packets received within a time interval of a sequence of time intervals. At the start of each new time interval, the statistics engine may set a flag indicating whether or not the packets-per-interval count for the previous time interval was equal to or greater than the packets-per-interval threshold. The flag may be saved in the memory as part of the traffic statistics associated with the extracted PGID.