An example network device includes a memory configured to store a plurality of counts of packets of a data flow. The network device also includes one or more processors in communication with the memory. The one or more processors are configured to determine the plurality of counts of packets of the data flow, wherein each count of the plurality of counts includes a number of packets occurring in a predetermined time period. The one or more processors are configured to assign a corresponding range to each count of the plurality of counts, so as to assign a plurality of corresponding ranges. The one or more processors are also configured to determine a pattern in the plurality of corresponding ranges and send a number of active probe packets based on the determined pattern.