1. A device for detecting and filtering excessive Internet Protocol (IP) packets comprising: an examining section adapted to count input strings from IP packets traveling from at least one IP source outside a security perimeter to at least one network device within the security perimeter; and a system control section adapted to record indicators of the amount of counted input strings, by different classifications, in a uniformly random manner.