A method comprising: in response to receiving, by a software-defined wide area network, SD-WAN, network device, an application data packet of a data flow for an application, assigning, by the network device, the data flow to a default link of a plurality of links, wherein the plurality of links comprise a plurality of equal-cost multi-path, ECMP, links; in response to receiving the application data packet of the data flow, initiating, by the network device, a probing process for the data flow, wherein initiating the probing process for the data flow comprises: in response to receiving, by the network device, the application data packet of the data flow for the application, determining, by the network device, an application signature of the application data packet; determining, by the network device and based on the application signature, a set of one or more service level agreement, SLA, metrics for the application and a destination of the data flow; sending, by the network device, one or more probe packets on each of the plurality of links to determine respective QoE metrics for each ECMP link of the plurality of ECMP links; determining, by the network device and based on the respective QoE metrics for each link of the plurality of ECMP links, that the QoE metrics for a first link of the plurality of ECMP links satisfy the SLA metrics for the application; re-assigning, by the network device, the data flow from the default link to the first link; and refraining, by the network device, from sending additional probe packets on each ECMP link of the plurality of ECMP links other than the first link; detecting, by the network device, that the data flow is no longer being received by the network device; and in response to detecting that the data flow is no longer being received by the network device, ceasing, by the network device, the probing process for the data flow on the first link. in response to receiving, by a software-defined wide area network, SD-WAN, network device, an application data packet of a data flow for an application, assigning, by the network device, the data flow to a default link of a plurality of links, wherein the plurality of links comprise a plurality of equal-cost multi-path, ECMP, links; in response to receiving the application data packet of the data flow, initiating, by the network device, a probing process for the data flow, wherein initiating the probing process for the data flow comprises: in response to receiving, by the network device, the application data packet of the data flow for the application, determining, by the network device, an application signature of the application data packet; determining, by the network device and based on the application signature, a set of one or more service level agreement, SLA, metrics for the application and a destination of the data flow; sending, by the network device, one or more probe packets on each of the plurality of links to determine respective QoE metrics for each ECMP link of the plurality of ECMP links; determining, by the network device and based on the respective QoE metrics for each link of the plurality of ECMP links, that the QoE metrics for a first link of the plurality of ECMP links satisfy the SLA metrics for the application; re-assigning, by the network device, the data flow from the default link to the first link; and refraining, by the network device, from sending additional probe packets on each ECMP link of the plurality of ECMP links other than the first link; in response to receiving, by the network device, the application data packet of the data flow for the application, determining, by the network device, an application signature of the application data packet; determining, by the network device and based on the application signature, a set of one or more service level agreement, SLA, metrics for the application and a destination of the data flow; sending, by the network device, one or more probe packets on each of the plurality of links to determine respective QoE metrics for each ECMP link of the plurality of ECMP links; determining, by the network device and based on the respective QoE metrics for each link of the plurality of ECMP links, that the QoE metrics for a first link of the plurality of ECMP links satisfy the SLA metrics for the application; re-assigning, by the network device, the data flow from the default link to the first link; and refraining, by the network device, from sending additional probe packets on each ECMP link of the plurality of ECMP links other than the first link; detecting, by the network device, that the data flow is no longer being received by the network device; and in response to detecting that the data flow is no longer being received by the network device, ceasing, by the network device, the probing process for the data flow on the first link.