 controller. Finally, a third reason for choosing this size is the amount of computation that is done for each window. A list of 50 values can be computed much faster than 500 and an attack in a 50-packet window is detected earlier. We also tested the entropy with three other window sizes and measured the CPU and memory usage. There is no difference in memory usage but the CPU usage slightly increases with respect to the window size. Considering the limited resources of the controller, this window size is ideal for networks with one controller and few hundred hosts. Attack Detection For detecting an attack in the controller, we monitor the destination IP address of the incoming packets. A hash table of the arriving packets is developed by the addition of a function. In case of a new IP address in the table, it is added with count 1 which is incremented if its instance already exists in the table. After 50 packets, the entropy of the window will be calculated and it shows the hash table where X is the destination IP address and y is the number of times it appeared. To compute the entropy as can be shown by given equation, we conclude with new equation where W is the window and p is the probability of each IP address. Entropy becomes maximum when each IP address appears only once. If an attack is directed towards a host, a large number of packets will be directed to it. Entropy is reduced when these packets will fill most of the window and reduce the number of unique IPs in the window. We made use of this fact and set an experimental threshold. If the entropy drops below this threshold and that five consecutive windows have lower than threshold entropy, then an attack is in progress. Detection within 5 entropy periods is 250 packets in the attack, which gives the network an early alert of the attack. We tested with different values between one and five consecutive periods and, five has the lowest false positive for early detection. The other advantage of having five windows is the possibility of losing a switch or 