Abstract: Method for protecting an NSP data network against data overflow, according to which the NSP data network is divided to a protected sub-network and an unprotected sub-network. Connectivity to external data networks is allowed through the unprotected sub-network via a set of predefined controlled data ports. A maximum available bandwidth that can be processed by a user is determined for each user and maximal sub-bandwidth is allocated for each router. Whenever the data packet flow intended to the user exceeds the sub-bandwidth at one of the routers, the excess packet flow is filtered.

Abstract: Method for protecting an NSP data network against data overflow, according to which the NSP data network is divided to a protected sub-network and an unprotected sub-network. Connectivity to external data networks is allowed through the unprotected sub-network via a set of predefined controlled data ports. Each user is connected to the protected sub-network via a proxy router and to the unprotected sub-network via gateway routers that are connected to the proxy router through interconnected intermediating routers and to unprotected sub-network via the set of controlled data ports. A maximum available bandwidth that can be processed by a user is determined for each user and maximal sub-bandwidth is allocated for each router, such that the sub-bandwidth is smaller than the bandwidth.