System and Method for Avoiding and Mitigating a DDoS Attack

A method, comprising:

• receiving a data packet including a destination address and a source address;
• performing a first longest prefix match on the destination address;
• if a result of the first longest prefix match is an entry of a per customer table, performing a second longest prefix match on the source address;
• selecting a treatment for the data packet based on a result of the second longest prefix match.

A router, comprising:

• a receiving module receiving a data packet including a destination address and a source address;
• a first performing module performing a first longest prefix match on the destination address;
• a second performing module performing, if a result of the first longest prefix match is an entry of a per customer table, a second longest prefix match on the source address;
• a selecting module selecting a treatment for the data packet based on a result of the second longest prefix match.

A computer readable storage medium including a set of instructions executable by a processor, the set of instructions operable to:

• receive a data packet including a destination address and a source address;
• perform a first longest prefix match on the destination address;
• if a result of the first longest prefix match is an entry of a per customer table, perform a second longest prefix match on the source address;
• select a treatment for the data packet based on a result of the second longest prefix match.