Abstract: Service attacks, such as denial of service and distributed denial of service attacks, of a customer network are detected and subsequently mitigated by the Internet Service Provider (ISP) that services the customer network. A sensor examines the traffic entering the customer network for attack traffic. When an attack is detected, the sensor notifies an analysis engine within the ISP network to mitigate the attack. The analysis engine configures a filter router to advertise new routing information to the border and edge routers of the ISP network. The new routing information instructs the border and edge routers to reroute attack traffic and non-attack traffic destined for the customer network to the filter router. At the filter router, the attack traffic and non-attack traffic are automatically filtered to remove the attack traffic. The non-attack traffic is passed back onto the ISP network for routing towards the customer network.

Abstract: A communications network monitoring system and method remotely determines the total bandwidth between any two nodes on the network as well as the available bandwidth between nodes at a given time. A remote host sends data packets to each of the two nodes. A reply is sent back to the remote host generating a delay time. A set of delay times for data packets of various sizes is generated at the host. The data set is then analyzed using a robust estimation method and a Bayesian analysis to determine the total bandwidth and the mean delay between the two nodes. Moreover, the available bandwidth for a time, t, can be estimated by first injecting traffic into the network from a remote traffic generator to develop an estimate of the traffic and a router characteristic parameter, &ggr;. This constant and a Bayesian estimate of the &agr;(t) are used to estimate the available bandwidth at any given time t.