An apparatus and automatic method for detecting brown-outs in a computer network includes determining normal rates of different types of traffic with respect to defined address prefixes. Thresholds are established based on the normal rates. The rates for the different traffic types are monitored, and when a threshold is exceeded the detected addresses and traffic types are flagged for reporting. In some cases, the inventive system will monitor traffic to finer address granularities to further identify suspect addresses. The system may actively ping suspect sub-prefixes and/or initiate communications with the suspect sub-addresses that is then monitored to determine which sub-prefixes are experiencing abnormal activity.