the invention detects a denial of service attack at a node by monitoring the number of discarded packets in relationship to the number of inbound packets . when an attack is detected , relevant inbound packet information is collected during the attack to help characterize the attack and at least to pinpoint the source of the last hop to the attacked node .