One embodiment provides an apparatus. The apparatus includes client traffic management (CTM) logic. The CTM logic is to trigger implementation of a selected network traffic flow related to the client device, the triggering based, at least in part, on a network traffic flow related to the client device. The network traffic flow is associated with a connection and includes at least one subflow. Each subflow is carried by a respective path associated with the connection. The triggering includes at least one of constraining and/or adjusting an allowable throughput at a service provider for one or more of the at least one subflow. The selected traffic policy is to be implemented in a transport layer.

For managing a traffic overload in a software defined network having an SDN controller, when an indication of a traffic overload is received, there are steps of identifying traffic flows which contribute to this, identifying nodes of the network controllable by the SDN controller and located along a path of the identified traffic flows before the location of the traffic overload. The SDN controller is used to control the identified nodes to control the identified traffic flows to reduce the traffic overload. By using the SDN controller to control the reduction compared to diverting suspicious traffic flows to a separate external security server, the extra network resources used for carrying the diverted traffic flows are not needed, the separate security server is not needed, and the risk of such diverted traffic flows themselves causing overloads is reduced. It can be applicable to a range of causes of overload, including denial of service attacks.