A network monitoring device configured to collect a new packet from one or more observation points of a network and to compare the new packet with a list of a number of received packets based on a packet arrival rate and to identify a duplicate packet. In particular, the number of received packets in the list is equivalent to a number of packets received within a time period, i.e. the packet arrival rate. Stated differently, the network monitoring device is to compare the new packets with received packets stored in a queue of a buffer and wherein the queue has a size based on a packet arrival rate collected at one or more observation points. In addition, the time period is further adjusted according to a threshold value. The threshold value is a variable parameter that can be adjusted to compensate for different network deployment. In one embodiment, the threshold value is a time value that is not more than a transmission time of a TCP retransmitted packet.