Abstract: A method includes configuring a plurality of rate filters for a plurality of protocols. The plurality of rate filters are associated with a plurality of rate thresholds for the plurality of protocols. An edge device receives a packet for a flow. The packet is received from a customer premise equipment device for sending through an egress interface of the edge device. A rate of packets being sent for the flow and a protocol in the plurality of protocols associated with the packet are determined A rate filter in the plurality of rate filters that is associated with the determined protocol is determined where the rate filter is associated with a rate threshold in the plurality of rate thresholds. The method determines an event is occurring when the rate of packets exceeds the rate threshold associated with the determined rate filter and performs an action to mitigate the event.