Patent ID: 7207062

Claim:
A method of preventing denial of service attacks against a subscribing site, the method comprising: at or near a point of ingress of a packet into the Internet, determining whether a packet's destination is the subscribing site or the packet belongs to a connection to the subscribing site, the subscribing site being a site whose connections the point of ingress has agreed to monitor for conformance to congestion avoidance rules that limit a packet sender's transmission rate according to dynamic route properties; verifying whether the packet belongs to a connection that conforms to such congestion avoidance rules; and when the packet's destination is determined to be the subscribing site or is determined to belong to a connection to the subscribing site, and the packet is verified as belonging to a connection that conforms to such congestion avoidance rules and that the number of connections between the packet's source and destination is below a maximum allowed by the subscribing site, marking the packet for forwarding in a first of service that is distinct from any other class of service used for forwarding other packets; and when the packet does not qualify for the first class of service, marking the packet for forwarding in one of one or more classes of service that are different than the first class of service.