Method and system for controlling network access on a per-flow basis

Aspects of a method and system for controlling network access on a per-flow basis may comprise controlling access to a network by regulating at least one flow comprising one or more ingress packets based on a flow identifier associated with said one or more packets and based on an establishment of flows in said network. The flow identifier may comprise a source IP address, a destination IP address, a source MAC address, a destination MAC address, a network protocol, a source port number, and/or a destination port number. The number of flows permitted for a source and/or a rate at which a source is allowed to establish new flows may be limited. Flows that exceed one or more of these limits may be marked for further processing. Access to the network for the marked flows may be determined based on past and/or present network statistics. Flows received when a node is at capacity may also be marked for processing.