Normal mode is one of three detection modes (i.e. normal mode, rapid mode and smart mode) that monitors traffic flow sent from customer routers to provide early attack warnings and subsequently trigger the corresponding mitigation process when traffic continuously exceeds pre-defined detection thresholds for a certain time window, aka, LSP