In one embodiment, a protocol state associated with a port of a network device is determined to have expired. A port group of which the port is a member is determined, the port group including ports that share one or more common characteristics. A policy is applied to the ports of the port group to determine whether one or more other ports in the port group also have a corresponding protocol state protocol that has expired. In response to one or more other ports in the port group also having a corresponding protocol state that has expired, expiration of the protocol state is determined to be a false positive and no further action is taken based on expiration of the protocol state. When expiration of the protocol state is not determined to be a false positive, further action is taken based on expiration of the protocol state.