Effectiveness of rate-limiting in mitigating flooding DOS attacks