an apparatus is equipped to receive network traffic data for network traffic routed over one or more network links relevant to a network link . selected numbers of analysis are performed to determine if the network link of interest is being misused . the analyses include but are not limited to analyses to determine whether the network traffic routed are inconsistent with an expected traffic pattern , whether unallocated source addresses are present , whether source addresses exhibit an uncharacteristic even distribution pattern , whether a server is uncharacteristically excessive in responding to the same source address , whether normal bursty behavior is absent from the traffic , whether a ratio of packets in one direction to packets in another direction is out of balance , whether a ratio of packets of one type to packets of another type is out of balance , and whether a server is uncharacteristically excessive in responding with error responses .