Abstract: The method and apparatus of the present invention provide real time detection of abnormal data streams in high bandwidth data pipes, such as those found at network service provider data hubs. Abnormally high data volumes, for example, those associated with Denial of Service [DOS] attacks, may be detected and a mitigating response to the attack initiated. Further, certain counterattack steps are instituted including reverse tracing to determine the source of the attack and attack signature recording for later comparison to suspected new attacks. The method and apparatus of the present invention are such that the entire volume of data passing through a high bandwidth data pipe may be monitored on a real time basis providing early warning of DOS attacks for very large network address spaces.