Patent ID: 7649886
Filing Date: 2010-01-19
Classification: H04L

Abstract:
1. A method for processing incoming packets in a communication network, each packet having a source address and a destination address, the method comprising: filtering the incoming packets in real time using a recent offender list; and classifying the filtered incoming packets as offending packets and non-offending packets in non-real time based on: retrieving a source address and a destination address of a packet from a background header processing queue; checking if the source address of the packet is present in a known good multi-association list; terminating any further processing for the source address when the source address is present in the known good multi-association list; checking if the source address is present in a recent history list; adding the source address to the recent history list when the source address is not present in the recent history list; checking if the number of destination addresses associated with the source address of the packet in the recent history list is more than a predefined threshold value; adding the source address of the packet to the recent offender list if the number of destination addresses associated with the source address of the packet is more than the predefined threshold value; and updating the recent history list with the source address and the destination address of the packet when the number of destination addresses associated with the source address of the packet is less than the predefined threshold value and the destination address associated with the source address is not already present in the recent history list.