A method may involve: maintaining protocol status information for a network protocol, where the protocol status information includes protocol information generated by a protocol server and network traffic information indicative of how messages are conveyed from the protocol client to a network, and updating the protocol status information in response to intercepting a protocol message being conveyed between a protocol client and a protocol server. For example, the network protocol can be DHCP (Dynamic Host Configuration Protocol) and the protocol status information can be updated to include an IP (Internet Protocol) address assigned to the protocol client by the protocol server in the protocol message. Such a method may inhibit the misuse of one or more network protocols and/or attacks on protocol servers.