A network element includes a plurality of ports and processing circuitry. The ports are configured for connecting to a communication network. The processing circuitry is configured to receive a packet from the communication network via one of the ports, to assign the packet to a selected queue, to verify whether the packet matches a rule, wherein matching the packet to the rule depends on whether the selected queue is congested, and, when the packet matches the rule, to apply to the packet an action associated with the rule.