a method and apparatus for enabling a network security service and network security infrastructure to detect , identify , mitigate , neutralize , and disable worms through distributed worm probes that can be linked to centralized monitoring systems for emergency response process is disclosed . the worm probes track packets with destination unreachable errors on a per source ip address basis . in one embodiment , when the number of such errors exceeds a predefined local threshold , e . g ., within a predefined local time period at a worm probe , the count of such errors as well as the source ip address will be sent to all other worm probes in the network as an alert . when the number of such errors exceeds a predefined global threshold , e . g ., within a predefined global time period , traffic from the endpoint device with the identified source ip address will be blocked to prevent that endpoint device from spreading worms further .