ECMP is configured across three equal-cost fibre paths from the NOC to a shared regional hub, but monitoring shows one path consistently carries far more traffic than the other two, even though hundreds of independent sessions exist. What is the most likely explanation, assuming all three routes are correctly configured at equal distance and priority?

ECMP's distribution across equal-cost paths depends on hashing a set of session attributes, and with a limited or particular mix of source/destination combinations, that hash can produce an uneven split across the available paths even though every route is correctly configured at identical distance and priority; this is a known characteristic of hash-based load distribution and is generally addressed by reviewing or adjusting the load-balancing method's inputs rather than assuming a fault. ECMP does not have a built-in limit that disables itself once more than two equal paths exist — three or more equal-cost routes are a normal, supported ECMP scenario. If one route genuinely had a lower administrative distance, it would not be an ECMP candidate at all; it would simply be the sole active route and the other two would not carry any traffic, which does not match the described symptom of uneven but shared traffic across all three. Routing-table corruption is not a real, diagnosable FortiOS condition to reach for here, and reaching for a rebuild would skip over the far more likely and checkable explanation. A reasonable operational step is to review how many distinct source/destination pairs are actually in use and consider whether the hash inputs, given that mix, would be expected to distribute evenly before assuming anything is broken.