Network monitors can be implemented as passive devices. Countermeasures can be applied selectively and against specific sources without having to affect legitimate users5.1. Rather than having to adopt an all-or-nothing strategy, systems can be built that tighten security gradually as the problems persist.