added support for "normal" case when no ddos observed, and future hook
for special case, when we will collect all the info to specific dst_ip