A method comprising: at each packet security gateway of a plurality of packet security gateways (112, 114, 116, 118) that provide an interface across different boundaries of a network (102, 104, 106, 108) protected by the plurality of packet security gateways and an unprotected network: receiving, by the packet security gateway and from a security policy management server external from the network protected by the packet security gateway, a dynamic security policy comprising a set of packet filtering rules to be applied to all network traffic traversing the boundary, wherein the set of packet filtering rules were automatically created or altered by the security policy management server based on malicious traffic information received from a malicious host tracker service, and wherein the set of packet filtering rules comprises a first packet filtering rule specifying: a set of network addresses; a Session Initiation Protocol [hereafter SIP] Uniform Resource Identifier [hereafter URI]; and a first packet transformation function configured to route or switch packets to a network address corresponding to a monitoring device; receiving, by the packet security gateway, packets associated with a network protected by the packet security gateway; and performing, by the packet security gateway and on a packet by packet basis, packet filtering on the received packets associated with the network traffic traversing the boundary via the packet security gateway based on the set of packet filtering rules by performing at least the first packet transformation function specified by the first packet filtering rule on at least one packet of the received packets that falls within the set of network addresses and matches the SIP URI, wherein performing the first packet transformation function comprises: encapsulating the at least one packet with an IP header that specifies the network address corresponding to the monitoring device, wherein the network address corresponding to the monitoring device is different from a destination network address specified by the at least one packet; and routing, based on the IP header, the at least one packet to the network address corresponding to the monitoring device, wherein routing the at least one packet to the network address causes the monitoring device to copy information contained in the at least one packet and to forward the at least one packet to the destination network address specified by the at least one packet. receiving, by the packet security gateway and from a security policy management server external from the network protected by the packet security gateway, a dynamic security policy comprising a set of packet filtering rules to be applied to all network traffic traversing the boundary, wherein the set of packet filtering rules were automatically created or altered by the security policy management server based on malicious traffic information received from a malicious host tracker service, and wherein the set of packet filtering rules comprises a first packet filtering rule specifying: a set of network addresses; a Session Initiation Protocol [hereafter SIP] Uniform Resource Identifier [hereafter URI]; and a first packet transformation function configured to route or switch packets to a network address corresponding to a monitoring device; a set of network addresses; a Session Initiation Protocol [hereafter SIP] Uniform Resource Identifier [hereafter URI]; and a first packet transformation function configured to route or switch packets to a network address corresponding to a monitoring device; receiving, by the packet security gateway, packets associated with a network protected by the packet security gateway; and performing, by the packet security gateway and on a packet by packet basis, packet filtering on the received packets associated with the network traffic traversing the boundary via the packet security gateway based on the set of packet filtering rules by performing at least the first packet transformation function specified by the first packet filtering rule on at least one packet of the received packets that falls within the set of network addresses and matches the SIP URI, wherein performing the first packet transformation function comprises: encapsulating the at least one packet with an IP header that specifies the network address corresponding to the monitoring device, wherein the network address corresponding to the monitoring device is different from a destination network address specified by the at least one packet; and routing, based on the IP header, the at least one packet to the network address corresponding to the monitoring device, wherein routing the at least one packet to the network address causes the monitoring device to copy information contained in the at least one packet and to forward the at least one packet to the destination network address specified by the at least one packet. encapsulating the at least one packet with an IP header that specifies the network address corresponding to the monitoring device, wherein the network address corresponding to the monitoring device is different from a destination network address specified by the at least one packet; and routing, based on the IP header, the at least one packet to the network address corresponding to the monitoring device, wherein routing the at least one packet to the network address causes the monitoring device to copy information contained in the at least one packet and to forward the at least one packet to the destination network address specified by the at least one packet.