1. A computer implemented method for identifying a subset of a multiplicity of source networks, said subset including one or more source networks which have sent messages to one of a plurality of destination locations having a same IP address, said method comprising the steps of: determining for each of said multiplicity of source networks whether there are fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations, and if so, identifying said each source network as included in said subset, and if not, not identifying said each source network as included in said subset.