A Distributed Denial of Service (DDoS) attack is a simultaneous and continuing barrage of Internet traffic directed at a target website that overwhelms network and/or server resources and effectively shuts down the victim site. The attack originates from hundreds or thousands of zombie programs placed surreptitiously on computers around the world making it extremely difficult to defend against. DDoS protection works by ‘learning’ customers’ traffic characteristics and reacts to traffic the modules recognize as illegitimate. The modules divert all traffic from the target site, analyze the packets and remove DDoS components so that clean traffic can flow to the intended site. The modules constantly filter the traffic and stay on alert for evolving attack patterns. This allows the customer to continue to do business in the face of a DDoS attack, rather than to shut down to protect data or change their IP to one not under attack which disrupts normal service and Internet relationships.