Techniques are disclosed regarding receiving a plurality of flows of network packets and determining, by processing logic of a device, a hash value for each of the network packets of the flows, wherein the hash value indicates the flow of network packets that a network packet belongs to. Based on the hash value, one of a plurality of interface ports of a multipath group of the device can be selected for output of network packets from two of the flows of network packets. Network packets from the two flows of network packets to be output by the interface port can be stored. Upon determining that a number of packets stored from the one of the two flows of network packets meets a first threshold, one of the two flows of network packets can be identified as a congestion contributing flow.