A device may determine a first aggregation level for aggregating incoming packets. The device may aggregate the incoming packets using the first aggregation level. The device may determine that a controlled packet pass rate for the incoming packets satisfies an arrival rate threshold based on aggregating the incoming packets using the first aggregation level. The device may determine a bandwidth violation trend associated with the incoming packets and the first aggregation level based on determining that the controlled packet pass rate satisfies the threshold. The device may determine that flow suppression is not effective at the first aggregation level based on the bandwidth violation trend, and may determine a second aggregation level based on determining that the flow suppression is not effective. The device may set the first aggregation level to the second aggregation level. The device may use the first aggregation level for aggregating additional incoming packets.