A messaging system comprising: at least one message interceptor node (2,3,4) having a processor and ports adapted to receive messages at a point in a communications network, at least one flood detect node, each flood detect node having a processor adapted to: extract data from a message, generate at least one code from the extracted data and save said code to a database, compare the code or codes with one or more previous codes, and determine according to the comparison if the received message is suspected to be a flooding message, characterized in that, said processor is adapted to perform said comparing and processing steps by: providing a set of a fixed number of data buckets, each said bucket having an associated code, a fill parameter value, a time stamp indicating the last time it was incremented, a leak rate indicating a decrease in the fill parameter with time, and an identifier of an associated flood detect algorithm, selecting a bucket according to the generated code, and incrementing a fill parameter of the selected bucket, determining suspicion of flooding by executing the associated flood detection algorithm, and saving flood-detection data to persistent memory if there is suspected flooding. at least one message interceptor node (2,3,4) having a processor and ports adapted to receive messages at a point in a communications network, at least one flood detect node, each flood detect node having a processor adapted to: extract data from a message, generate at least one code from the extracted data and save said code to a database, compare the code or codes with one or more previous codes, and determine according to the comparison if the received message is suspected to be a flooding message, characterized in that, said processor is adapted to perform said comparing and processing steps by: providing a set of a fixed number of data buckets, each said bucket having an associated code, a fill parameter value, a time stamp indicating the last time it was incremented, a leak rate indicating a decrease in the fill parameter with time, and an identifier of an associated flood detect algorithm, selecting a bucket according to the generated code, and incrementing a fill parameter of the selected bucket, determining suspicion of flooding by executing the associated flood detection algorithm, and saving flood-detection data to persistent memory if there is suspected flooding. extract data from a message, generate at least one code from the extracted data and save said code to a database, compare the code or codes with one or more previous codes, and determine according to the comparison if the received message is suspected to be a flooding message, characterized in that, said processor is adapted to perform said comparing and processing steps by: providing a set of a fixed number of data buckets, each said bucket having an associated code, a fill parameter value, a time stamp indicating the last time it was incremented, a leak rate indicating a decrease in the fill parameter with time, and an identifier of an associated flood detect algorithm, selecting a bucket according to the generated code, and incrementing a fill parameter of the selected bucket, determining suspicion of flooding by executing the associated flood detection algorithm, and saving flood-detection data to persistent memory if there is suspected flooding. providing a set of a fixed number of data buckets, each said bucket having an associated code, a fill parameter value, a time stamp indicating the last time it was incremented, a leak rate indicating a decrease in the fill parameter with time, and an identifier of an associated flood detect algorithm, selecting a bucket according to the generated code, and incrementing a fill parameter of the selected bucket, determining suspicion of flooding by executing the associated flood detection algorithm, and saving flood-detection data to persistent memory if there is suspected flooding.