Method and a device for detecting originators of data frame storms

A network element comprising:

• at least one ingress port for connecting to a data transfer network,
• a central processor unit for performing processes related to data transfer protocols, and
• a device for detecting one or more originators of a data frame storm received at the at least one ingress port,
• wherein the device comprises a processing system configured to:
• detect the data frame storm on the basis of amount of data frames related to various originators and received at the at least one ingress port,
• identify an originator of a received data frame in response to a detection of the data frame storm,
• update a measurement value related to the identified originator in response to the detection of the data frame storm, and
• detect, in response to the detection of the data frame storm and on the basis of the updated measurement value, whether the identified originator is one of the one or more originators of the detected data frame storm, and
• wherein the network element is configured to restrict or block access of data frames related to the data frame storm to the central processor unit.

A method for detecting one or more originators of a data frame storm, the method comprising:

• detecting a data frame storm on the basis of amount of data frames related to various originators and received at a network element, and
• identifying an originator of a received data frame in response to the detection of the data frame storm,
• wherein the method further comprises the following actions in response to the detection of the data frame storm:
• updating a measurement value related to the identified originator, and
• detecting, on the basis the updated measurement value, whether the identified originator is an originator of the detected data frame storm.

A non-transitory computer readable medium encoded with a computer program for detecting one or more originators of a data frame storm, the computer program comprising computer executable instructions for controlling a programmable processor to:

• detect a data frame storm on the basis of amount of data frames related to various originators and received at a network element, and
• identify an originator of a received data frame in response to a detection of the data frame storm,
• wherein the computer program further comprises computer executable instructions for controlling the programmable processor to carry out the following actions in response to the detection of the data frame storm:
• update a measurement value related to the identified originator, and
• detect, on the basis the updated measurement value, whether the identified originator is an originator of the detected data frame storm.