Patent ID: 7966661
Filing Date: 2011-06-21
Classification: H04L

Abstract:
1. A method comprising: determining whether a received packet is a trusted packet or a candidate attack request packet that is configured to cause an intermediary node to communicate to an end system an amount of response data that is greater than an amount of data contained in the candidate attack request packet received by the intermediary node, the determining being based on at least a destination address associated with the end system and a source address associated with a source of the received packet; in an instance where the received packet is determined to be a trusted packet, processing the received packet without further constraints; in an instance where the received packet is determined to be a candidate attack request packet, adding the amount of data contained in the candidate attack request packet to an account associated with the source of the received packet so that the account indicates a total amount of data received from the source minus an amount of data sent on behalf of the source; and, processing the received candidate attack request packet in an instance where the amount of response data of the candidate attack request packet is less than the total amount.