Presented herein are techniques for detection and characterization of buffer occupancy of a buffer in a network device. Packets are received at a network device. The packets are stored in a buffer of the network device as they are processed by the network device. An occupancy level of the buffer is sampled at a sampling rate. Occupancy levels of the buffer over time are determined from the sampling, and traffic flow through the network device is characterized based on the occupancy levels.