Patent ID: 8281400

Claim:
A method for identifying a source of an attack in a network, comprising: transmitting, to a network device implemented at least partially in hardware, a Border Gateway Protocol (BGP) route that identifies an address of an attack target, and a BGP community tag representing a destination class associated with the attack; configuring, based on the BGP community tag, the network device with a policy that assigns the route to the destination class associated with the attack; determining, by the network device and in response to configuring the network device with the policy, if data is destined for the attack target; monitoring, based on the destination class and for each input interface of a plurality of input interfaces of the network device, data destined for the attack target; determining, by the network device, a potential source of the attack based on the monitoring, the potential source of the attack being associated with at least one of the plurality of input interfaces; filtering, by the network device, data received on the at least one of the pluraity of input interfaces that receives the data destined for the attack target; and not filtering, by the network device, data received on at least one of the plurality of input interfaces that does not receive the data destined for the attack target.