IDENTIFYING ABNORMAL NETWORK TRAFFIC

A method of identifying traffic within a network representative of an abnormal network condition, including: monitoring a communications link for a high traffic volume level; identifying a domain being the source of the high traffic volume level; identifying within the domain, a sending entity transmitting traffic from the domain; using a detector located at or proximate to the domain to invoke a response from the sending entity; wherein a failure by the sending entity to provide an expected response to the message in accordance with a network protocol indicates that the traffic transmitted by the sending entity is traffic representative of an abnormal network condition.