leaky bucket state machines police packets and throttle packets of a stream or streams that are flowing from hosts towards the processor of a switch or router of a network . the throttling is performed by measuring and analyzing the actual flow rate of the streams &# 39 ; packets . the actual flow rate is compared to a predetermined threshold , which may be based on historical or estimated normal traffic patterns . if the actual flow rate exceeds the threshold associated with characteristics that relate packets to certain streams , packets are discarded from the streams having excessive flow rates . by discarding excessive packets having characteristics that correspond to packet information that typically causes a switch / router &# 39 ; s processor to execute operations , the effects of a dos attack are minimized while also minimizing the discarding of legitimate traffic packets .