Disclosed herein are systems, methods, and computer-readable storage media for analyzing packet flows and generating an alarm and for active testing of a network to localize problems. The system analyzes packet flows for bitstreams associated with a network node in order to compute a measure of protection that a queue of the network node gives to a high-priority one of the bitstreams relative to a low-priority one of the bitstreams, and uses the measure of protection to determine whether the network node is a source of a protection error with respect to priority markings for packets flowing through the network node, and generates an alarm upon determining that the network node is a source of a protection error with respect to the priority markings for the packets flowing through the network node.