A method to manage communication over a network with a packet traffic management device, PTMD, that performs actions, comprising: monitoring, by the PTMD, one or more performance metrics for a plurality of network flows; and when the one or more performance metrics indicate a flood attack of packets on one or more network flows of the plurality of network flows, performing, by the PTMD, further actions, including: determining, by the PTMD, one or more network destinations that are separately targeted for the flood attack based on at least network traffic on the one or more network flows; activating, by the PTMD, one or more mitigation procedures on the one or more determined network destinations that are separately targeted; monitoring, by the PTMD, network traffic that is communicated to the one or more determined network destinations; when the one or more performance metrics indicate that the flood attack is continuing on the one or more network flows, determine, by the PTMD, one or more other network destinations based on network traffic on the one or more network flows, wherein the one or more mitigation procedures are activated on the one or more other network destinations; and when one or more characteristics of the monitored network traffic indicate that the flood attack is over, deactivating, by the PTMD, the one or more mitigation procedures for the one or more determined network destinations. monitoring, by the PTMD, one or more performance metrics for a plurality of network flows; and when the one or more performance metrics indicate a flood attack of packets on one or more network flows of the plurality of network flows, performing, by the PTMD, further actions, including: determining, by the PTMD, one or more network destinations that are separately targeted for the flood attack based on at least network traffic on the one or more network flows; activating, by the PTMD, one or more mitigation procedures on the one or more determined network destinations that are separately targeted; monitoring, by the PTMD, network traffic that is communicated to the one or more determined network destinations; when the one or more performance metrics indicate that the flood attack is continuing on the one or more network flows, determine, by the PTMD, one or more other network destinations based on network traffic on the one or more network flows, wherein the one or more mitigation procedures are activated on the one or more other network destinations; and when one or more characteristics of the monitored network traffic indicate that the flood attack is over, deactivating, by the PTMD, the one or more mitigation procedures for the one or more determined network destinations. determining, by the PTMD, one or more network destinations that are separately targeted for the flood attack based on at least network traffic on the one or more network flows; activating, by the PTMD, one or more mitigation procedures on the one or more determined network destinations that are separately targeted; monitoring, by the PTMD, network traffic that is communicated to the one or more determined network destinations; when the one or more performance metrics indicate that the flood attack is continuing on the one or more network flows, determine, by the PTMD, one or more other network destinations based on network traffic on the one or more network flows, wherein the one or more mitigation procedures are activated on the one or more other network destinations; and when one or more characteristics of the monitored network traffic indicate that the flood attack is over, deactivating, by the PTMD, the one or more mitigation procedures for the one or more determined network destinations.