A network analyzer includes a hardware-based accounting engine that
generates accurate statistics for traffic within a computer network. As
the network analyzer receives packets, the accounting engine associates
the network packets with respective routing prefixes, and updates flow
statistics for the routing prefixes. In this manner, the accounting
engine maintains accurate flow statistics for all packets received by
network analyzer. The network analyzer includes a control unit that
generates prefix data to control the granularity of the traffic analysis.
The control unit analyzes the flow statistics maintained by the
accounting engine, and adaptively updates the set of prefixes to control
the granularity of the statistics. The control unit may generate the
prefix data as a forwarding tree having resolution nodes. Each node may
associate a network prefix with forwarding next hop data, as well as
respective analysis control data to enable or disable flow analysis for
the prefix.