Systems and methods for detecting and preventing flooding attacks in a network environment

1. A method for processing network traffic data, comprising:

receiving a packet;

determining whether the packet is a previously dropped packet that is being retransmitted; and

dropping the packet if the packet is not a retransmission of a previously dropped packet.

2. The method of claim 1 , further comprising performing a task based at least in part on a result from the act of determining, the task selected from the group consisting of dropping a packet, terminating a session, and sending a message to a user.

3. The method of claim 1 , wherein the packet comprises a header selected from the group consisting of a TCP header, an IP header, an UDP header, and an ICMP header.

4. A method for processing network traffic data, comprising:

receiving a packet;

determining whether the packet is a previously dropped packet that is being retransmitted;

dropping the packet when the packet is not a retransmission of a previously dropped packet; and

wherein the determining comprises comparing the received packet against one or more records in a log, each of the one or more records associating with a previously received packet; and

wherein the determining further comprises:

identifying a first transmission time of the received packet;

identifying a second transmission time of a previously received packet;

calculating a period between the first and second transmission times; and

determining whether the period is within a prescribed threshold.

5. The method of claim 4 , wherein the packet is determined to be a previously dropped packet if the period is within the prescribed threshold.

6. A method for processing network traffic data, comprising:

receiving a packet;

determining whether the packet is a previously dropped packet that is being retransmitted;

updating a counter based at least in part on the received packet;

determining whether the counter exceeds a prescribed threshold; and

when the counter exceeds the prescribed threshold and the packet is determined to not to be a retransmitted, previously dropped packet, dropping the packet.

7. The method of claim 6 , wherein the counter comprises a concurrent session counter.

8. The method of claim 6 , wherein the counter comprises a rate-based counter.

9. The method of claim 6 , wherein the prescribed threshold is data type specific.

10. The method of claim 6 , wherein the determining whether the packet is a previously dropped packet that is being retransmitted is performed only when the counter exceeds the prescribed threshold.

11. A method for processing network traffic data, comprising:

receiving a packet;

determining whether the packet is a previously dropped packet that is being retransmitted;

when the packet is determined not to be a retransmitted, previously dropped packet, dropping the packet; and

when the packet is determined to be a retransmitted, previously dropped packet, determining whether the packet is associated with a flooding attack.

12. A system for processing network traffic data, comprising:

means for receiving a packet;

means for determining whether the packet is a previously dropped packet that is being retransmitted; and

means for dropping the packet if the packet is not a retransmission of a previously dropped packet.

13. A computer product includes a non-volatile or volatile computer-readable medium, the computer-readable medium having a set of stored instructions, an execution of which causes a process to be performed, the process comprising:

receiving a packet;

determining whether the packet is a previously dropped packet that is being retransmitted; and

dropping the packet if the packet is not a retransmission of a previously dropped packet.