Methods, systems, and devices for monitoring network capacity and determining network utilization are herein disclosed. A traffic flow of captured data packets received at an ingress port of a network captured traffic distribution device may be sampled at a frequency corresponding to a first time period. The sample may be analyzed to determine whether, for example, the ingress port is active during the first time period. An increment may be added to a first counter based on a determination that the ingress port is active. The increments from a predefined plurality of first time periods may be aggregated and the predefined plurality of first time periods may correspond to a second time period. A second counter value may be generated for the second time period based on the aggregate and a percent utilization of the ingress port for the second time period may be determined based on the second counter value.