An analytics and diagnostic node according to the present disclosure monitors oversubscription and determines flow metrics by receiving mirror command frames from one or more switching nodes. The mirror command frames could correspond to a multiple flows traversing over a connection within a network. The analytics and diagnostic node collects at least one latency metric for each of the flows using timestamps found within the mirror command frames. Based on the latency metrics and timestamps, the analytic diagnostic node determines an average data rate for each of the flows. The analytics and diagnostic node also computes the cumulative data rates corresponding to different bucket intervals based on the average data rates. To detect oversubscription, the analytics and diagnostic node compares the cumulative data rates with one or more oversubscription rules.