Systems, methods, and devices are described that monitor network traffic. One method includes monitoring a number of packets received by a network device based on a number of criteria to determine a flow of the packets. For each monitored packet for a particular source IP address/destination IP address pair, the method includes hashing a destination TCP/UDP port number into a range [0 . . . N]. The method further includes setting a bit in a bit field that has a width of N+1 bits based on the hashing.