Hop-count filtering: an effective defense against spoofed DDoS traffic
Experience with EMERALD to Date