Technology is described for managing network traffic directed to a plurality of destination internet protocol (IP) addresses that are served by a destination host or service. A network action communication for a destination IP address served by the destination host or service may be received. The destination host or service may be overloaded when a number of network action communications directed to the plurality of destination IP addresses served by the destination host or service exceeds a defined threshold. The network action communications may be dropped in order to prevent the destination host or service from receiving a volume of network traffic that exceeds the defined threshold.