1. A device for detecting and filtering excessive Internet Protocol (IP) packets comprising: an examining section adapted to count strings of IP packets traveling from at least one IP source outside a security perimeter to at least one network device within the security perimeter; a system control section adapted to record indicators of the amount of counted strings, by different classifications, using an IP-address based hash function, wherein at least one of the classifications is based on a destination IP address and further vary a number of storage areas, each area used to store one or more of the indicators, to avoid a false indication of a malicious attack of IP packets; and a monitoring section adapted to determine when an amount of stored indicators in a particular classification is greater than an amount of estimated indicators during a set period of time for a particular classification, thereby creating an overflow of stored indicators in said classification, wherein one of the indicators is an overcrowding indicator, the monitoring section further adapted to compare the value of the overcrowding indicator to a predetermined level in order to avoid a false indication of a malicious attack of IP packets.