Packet flows received in a data network are assigned to respective entries of a database. During an accumulation interval byte counts of the assigned packet flows are accumulated in the respective database entries. The packet flows are classified as elephant flows when differences between the byte counts and a reference byte count exceed a threshold and are reported after expiration of the accumulation interval.