A monitoring device disposed for thwarting denial of service attacks on
the data center is described. The monitoring device includes a plurality
of probe devices that are disposed to collect statistical information on
packets that are sent between the network and the data center and a
cluster head coupled to each of the plurality of probe devices, the
cluster head receiving collected statistical information from the probe
devices and determining from the collected information whether the data
center is under a denial of service attack.