Systems, methods, and computer storage media for measuring traffic utilization are provided. The method includes timing predetermined time intervals that are relatively small to provide for real-time monitoring of a system. A count of the bytes received is identified in order to monitor a number of bytes received within the predetermined time interval. When the number of bytes received exceeds a predetermined threshold, a larger time interval is captured such that the system can identify how many times the number of bytes received exceeded the predetermined threshold within the larger time interval. When the number of bytes received exceeds the predetermined threshold a number of times greater than a violation threshold, an alarm is generated. This allows a system to monitor high frequency violations. Also, the counts for each time interval are continuously zeroed out after the time interval expires, thus, eliminating a need for calculations.