Patent ID: 8762334

Claim:
A device comprising: a plurality of interfaces, each interface comprising: a local database to store, in a first plurality of local records, information associated with a plurality of data units sent from or received by the interface; and a processor to: send at least one of the plurality of data units to a destination address; determine if information contained in the at least one of the plurality of data units matches information stored in the local database; create, when the information contained in the at least one of the plurality of data units does not match the information stored in the local database, an entry in the local database, the entry including: a source address associated with a respective data unit of the at least one of the plurality of data units, and a destination address associated with the respective data unit; determine, when the information contained in the at least one of the plurality of data units does not match the information stored in the local database, if the processor receives a reply from the destination address; increment a timer by a particular value, the timer acting as a counting wheel and being incremented by the particular value after each data unit, of the plurality of data units, is sent to the destination address; determine, when the incremented timer elapses, if the processor receives a reply from the destination address; update, when the processor receives the reply from the destination address, the information stored in the local database, the processor, when updating the information stored in the local database being to: remove the entry; and create a record associated with the respective data unit, the record including: the source address, and the destination address; broadcast, based on updating the local database and when the incremented timer elapses, the information stored in the local database to one or more other interfaces of the plurality of interfaces; process, when the processor does not receive a reply from the destination address, the at least one of the plurality of data units sent to the destination address to obtain a threshold value; and mark the at least one of the plurality of data units as an anomaly when the threshold value exceeds a threshold.