Tracking application behavior based on packet spacing

A computer system with multiple links over which data is being communicated, the computer system comprising:

• a processor;
• and
• a storage device storing instructions which when executed by the processor comprise instructions to:
• track activity over a respective link for a predetermined amount of time, wherein the activity comprises at least one of a number of idle periods or a duration of a respective idle period;
• divide a predetermined time interval into a number of bins, wherein a respective bin is associated with a range of time within the predetermined time interval;
• store the tracked activity in a data structure, wherein an entry in the data structure indicates the number of bins, a duration of time associated with a respective bin, and a count associated with the respective bin;
• mark the tracked activity in the entry for the respective link by incrementing a count associated with a bin matching the duration of the respective idle period based on a first number of idle periods tracked for the matching duration;
• and
• display the stored tracked activity for the respective link.

A non-transitory computer-readable medium storing instructions to:

• track, in a network device with multiple links over which data is being communicated, activity over a respective link for a predetermined amount of time, the activity comprising at least one of a number of idle periods or a duration of a respective idle period;
• partition a predetermined time interval into a number of bins, a respective bin associated with a range of time within the predetermined time interval;
• store the tracked activity in data structure entries, a respective entry indicating the number of bins, a duration of time associated with a respective bin, and a count associated with the respective bin;
• mark the tracked activity in the entry for the respective link by incrementing a count associated with a bin matching the duration of the respective idle period based on a first number of idle periods tracked for the matching duration;
• and
• display the stored tracked activity for the respective link.