A method and system are provided for monitoring network performance in order to reveal micro-behavior of network traffic. At least two distinct durations are set for monitoring link utilization. At least one link utilization threshold is set for each duration. Link utilization is monitored at a router using a counter. In addition, a number of durations is provided during which the at least one link utilization threshold has been exceeded.