A network element includes multiple ports and logic. The multiple ports are configured to serve as ingress ports and egress ports for receiving and transmitting packets from and to a network. The logic is configured to queue the packets received from the ingress ports, run a packet-dropping process that randomly drops one or more of the queued packets to avoid congestion, while detecting and excluding from the packet-dropping process, at least probabilistically, packets belonging to a predefined packet type, and forward the queued packets, which were not dropped, to the egress ports.