A method for isolating legitimate network traffic during a denial of service attack involves receiving a plurality of packets from a network, detecting an attack from the network on a first virtual network stack, wherein the attack on the first virtual network stack comprises at least one from the group consisting of the denial of service attack and an extreme network load, if the attack is detected, forwarding a plurality of packets associated with a subsequent connection to a temporary data structure associated with a second virtual network stack, wherein the second virtual network stack is a lowest priority queue configured at connection setup time, determining whether the subsequent connection is legitimate, and forwarding at least one of the plurality of packets associated with the subsequent connection to a temporary data structure associated with the first virtual network stack if the subsequent connection is legitimate, wherein a higher priority mapping is assigned by a classifier to the subsequent connection.