Abstract: Examples described herein relate to a programmable packet processing pipeline configured to: access a data corresponding to multiple bins, respective bins associated with multiple packet flows and for respective bins: identify a single flow associated with a bin of the multiple bins as a candidate heavy hitter flow and determine a different packet flow as the candidate heavy hitter flow for the bin of the multiple bins.