A microburst monitoring system includes a port and a memory system with an egress queue and a shadow queue that are associated with the port. A networking engine is coupled to the port and the memory system and configured to receive and process packets to provide egress frames for forwarding through the port. The networking engine then stores the egress frames in the egress queue, and stores information about each of the egress frames in the shadow queue. When the networking device determines that the storage of the egress frames has caused the egress queue to reach a threshold, the networking device causes the information about each of the egress frames in the egress queue to be captured, and that captured information may be analyzed to determine a source device that is generating at least some of the packets to be throttled.