Patent ID: 8484372

Claim:
A system, comprising: a network device, comprising: a memory, and a processor to: detect an attack associated with first traffic received via a network connected to the network device, determine one or more characteristics of the first traffic, create control information based on the one or more characteristics of the first traffic, the control information including data identifying: at least one source address associated with the first traffic, at least one destination address associated with the first traffic, and a protocol associated with the first traffic, the creating of the control information further including: determining a rate limit value, and including data identifying the rate limit value in the control information; identify, based on the control information, one or more devices of a plurality of devices in the network: the one or more devices being different from the network device, and the network device, when identifying the one or more devices, being further to: determine whether the at least one source address can be verified, when the at least one source address cannot be verified, identify a plurality of network ingress devices in the network as the one or more devices, and when the at least one source address can be verified, identify only one or more particular network ingress devices of the plurality of network ingress devices that are associated with the at least one source address as the one or more devices, forward the control information to the one or more devices, the one or more devices filtering second traffic associated with the attack based on the rate limit value and one or more of the at least one source address associated with the first traffic, the at least one destination address associated with the first traffic, or the protocol associated with the first traffic, receive, from at least one device of the plurality of devices, information regarding characteristics of the second traffic, determine, based on the received information, that the attack has ended, and provide, to the one or more devices, an indication associated with determining that the attack has ended.