Abstract: A computer program product and method for screening packets at an interface between a local site and an external network. A heuristic profiler scrutinizes a candidate packet and calculates a value characterizing the IP source of the packet on the basis of prior encounters with the IP source as maintained in a hashed history table entry. A filter selectively passes packets from the external network to the site on the basis, at least, of the value ascribed to the source relative to a current threshold value determined on the basis of bandwidth usage.