Burst score

In one embodiment, a network device, includes at least one network interface port to serve as at least one ingress port for receiving network packets from a network and as at least one egress port for forwarding network packets to the network, a memory, control circuitry configured to monitor respective events in the network device, the respective events having respective event timestamps, and burst estimator logic to track respective rates of occurrence of ones of the events over respective time periods responsively to respective ones of the event timestamps, follow a maximum one of the rates of occurrence, store, in the memory, the maximum rate of occurrence, and find a measure of burstiness of the events responsively to the followed maximum rate of occurrence.