the guard device may instruct the router to divert only traffic on this port additionally or alternatively guard device 28 may set the diversion criteria dynamically based on parameters of the abnormal traffic it has detected for example if the guard device detects an abnormal increase in traffic on a certain port the guard device may then proceed to analyze the pattern of ip source addresses of the incoming traffic on this particular port it may then choose to divert or block all traffic received from these suspect ip source addresses for a certain period of time which may be for the duration of the attack as another example if the guard device detects an abnormal increase in incoming traffic on a certain port it may instruct the router to divert outgoing traffic on the same or related ports to the guard device as well in this manner the guard device may be able to detect and block packets transmitted by a computer in area 30 that has become infected fig3 is a flow chart that schematically shows details of event counting step 64 in accordance with an embodiment of the present invention the method is typically applied to each destination port individually guard device 28 may apply this method in order to avoid generating false alarms due to abnormal events that can occur due to causes other than malicious attacks for this purpose guard device 28 maintain a source list s of source addresses which have recently sent packets into protected area 30 with the given destination port number.