Abstract: In one embodiment, flows are monitored that are open for a length of time until ending by either a distinct ending or by being silent longer than a configured aging timer (wherein a silent flow is a “zombie flow”). In response to each first flow ending, a total flow time value may be increased by a length of time that first flow was open, and in response to each second flow ending by aging, a zombie flow time value may be increased by the aging timer. A ratio of zombie flows at a particular time in the computer network that will be ended by aging may be estimated as the zombie flow time value divided by the total flow time value. Also, in other embodiments, a capacity improvement, performance hit, and accuracy hit may be predicted based on a new aging timer value.