A method, comprising: receiving, by a processor of a software defined network, SDN, controller, an indication that a malicious packet has been detected by an intrusion prevention system, IPS, in a communication network; determining, by the processor, a list of source nodes that have a source Internet Protocol, IP, address that matches a source IP address of the malicious packet; determining, by the processor, a virtual local area network identification, VLAN ID, associated with a source node of the list of source nodes that sent the malicious packet; and instructing, by the processor, an edge switch to block additional packets from the source node of the list of source nodes having the VLAN ID, wherein when the VLAN ID associated with the list of source nodes comprises a plurality of VLAN IDs, the method further comprising: determining, by the processor, a list of destination nodes that have a destination IP address that matches a destination IP address of the malicious packet; creating, by the processor, a plurality of tuples comprising a source node of the list of source nodes, a destination node of the list of destination nodes and a suspected VLAN ID of a plurality of suspected VLAN IDs; creating, by the processor, a rule for each one of the plurality of tuples that diverts an incoming packet to the IPS; collecting, by the processor, traffic statistics for the rule for the each one of the plurality of tuples; and determining, by the processor, the suspected VLAN ID that generated a most amount of traffic using the rule for the each one of the plurality of tuples, is the VLAN ID to block. receiving, by a processor of a software defined network, SDN, controller, an indication that a malicious packet has been detected by an intrusion prevention system, IPS, in a communication network; determining, by the processor, a list of source nodes that have a source Internet Protocol, IP, address that matches a source IP address of the malicious packet; determining, by the processor, a virtual local area network identification, VLAN ID, associated with a source node of the list of source nodes that sent the malicious packet; and instructing, by the processor, an edge switch to block additional packets from the source node of the list of source nodes having the VLAN ID, wherein when the VLAN ID associated with the list of source nodes comprises a plurality of VLAN IDs, the method further comprising: determining, by the processor, a list of destination nodes that have a destination IP address that matches a destination IP address of the malicious packet; creating, by the processor, a plurality of tuples comprising a source node of the list of source nodes, a destination node of the list of destination nodes and a suspected VLAN ID of a plurality of suspected VLAN IDs; creating, by the processor, a rule for each one of the plurality of tuples that diverts an incoming packet to the IPS; collecting, by the processor, traffic statistics for the rule for the each one of the plurality of tuples; and determining, by the processor, the suspected VLAN ID that generated a most amount of traffic using the rule for the each one of the plurality of tuples, is the VLAN ID to block. determining, by the processor, a list of destination nodes that have a destination IP address that matches a destination IP address of the malicious packet; creating, by the processor, a plurality of tuples comprising a source node of the list of source nodes, a destination node of the list of destination nodes and a suspected VLAN ID of a plurality of suspected VLAN IDs; creating, by the processor, a rule for each one of the plurality of tuples that diverts an incoming packet to the IPS; collecting, by the processor, traffic statistics for the rule for the each one of the plurality of tuples; and determining, by the processor, the suspected VLAN ID that generated a most amount of traffic using the rule for the each one of the plurality of tuples, is the VLAN ID to block.