A method implemented by a first switch in a software defined networking (SDN) network to monitor a tunnel between the first switch and a second switch in the SDN network. The method includes generating a first flow entry that matches packets received over the tunnel, generating a second flow entry that matches packet received over the tunnel, where the second flow entry has a priority that is lower than a priority of the first flow entry, removing the first flow entry and transmitting a flow removed message to an SDN controller in response to a determination that the first flow entry has timed out, maintaining a statistic associated with the second flow entry, and transmitting a statistics trigger event message to the SDN controller in response to a determination that the statistic associated with the second flow entry exceeds a threshold value.