Abstract: Various embodiments include a method of maintaining lists of network characteristics of messages. The messages can be detected. The messages can travel near at least the first network node. The messages can comprise network characteristics. The lists of network characteristics of the messages can be updated. The lists include instances of the network characteristics, based on a frequency of occurrences of the instances.

Abstract: Various embodiments include methods and apparatuses limit connection resources at one or more first network nodes. In one method embodiment, at a second network node, a handshake message is detected; a pending network connection is randomly selected; and a message to end the randomly selected pending network connection is sent from the second node. Various embodiments have one or more elements that can begin if a total of pending network connections exceeds a threshold. In one apparatus embodiment, a packet sniffer component detects a handshake message; a random selection component is coupled to the packet sniffer and randomly selects a pending network connection; and a sending component is coupled to the random selection component and sends a message to end the randomly selected pending network connection. Various embodiments have one or more elements that can begin if a total of pending network connections exceeds a threshold.