Abstract: In example implementations, a method is disclosed for a software defined network (SDN) controller assisting an intrusion prevention system (IPS). The method includes receiving an indication that a malicious packet has been detected by an IPS in a communication network. A list of source nodes that have a source Internet protocol (IP) address that matches a source IP address of the malicious packet is determined. A virtual local area network identification (VLAN ID) associated with a source node of the list of source nodes that sent the malicious packet is determined. The SDN controller may instruct an edge switch to block additional packets from the source node of the list of source nodes having the VLAN ID.