A computer-implemented method for monitoring network connections by a mitigation service, the mitigation service monitoring network traffic in one direction between a client computer and a server computer, the method comprising: receiving, from the client computer, a connection request that is configured to establish a network connection between the client computer and the server computer, wherein the connection request comprises at least one parameter corresponding to the network connection; sending, to the client computer, a response that is configured to cause a reply by the client computer, wherein the response comprises a sequence number that is the same as a sequence number received in the connection request or an out-of-date time stamp and wherein the sequence number does not interrupt the establishment of the network connection between the client computer and the server computer and does not complete the establishment of the network connection between the client computer and the server computer; determining whether the reply is received from the client computer; and in response to determining that the reply is received from the client computer: sending the connection request to the server computer without altering an identification of the client computer in the request, wherein the method further comprises: determining that a number of connection requests from the client computer exceeds a predetermined threshold; and in response to determining that the number of connection requests exceeds the predetermined threshold, monitoring network traffic in both directions between the client computer and the server computer. receiving, from the client computer, a connection request that is configured to establish a network connection between the client computer and the server computer, wherein the connection request comprises at least one parameter corresponding to the network connection; sending, to the client computer, a response that is configured to cause a reply by the client computer, wherein the response comprises a sequence number that is the same as a sequence number received in the connection request or an out-of-date time stamp and wherein the sequence number does not interrupt the establishment of the network connection between the client computer and the server computer and does not complete the establishment of the network connection between the client computer and the server computer; determining whether the reply is received from the client computer; and in response to determining that the reply is received from the client computer: sending the connection request to the server computer without altering an identification of the client computer in the request, sending the connection request to the server computer without altering an identification of the client computer in the request, wherein the method further comprises: determining that a number of connection requests from the client computer exceeds a predetermined threshold; and in response to determining that the number of connection requests exceeds the predetermined threshold, monitoring network traffic in both directions between the client computer and the server computer. determining that a number of connection requests from the client computer exceeds a predetermined threshold; and in response to determining that the number of connection requests exceeds the predetermined threshold, monitoring network traffic in both directions between the client computer and the server computer.