If the success rate has not increased, then after termination of the interval, it is determined whether the success rate is at or below one or more thresholds, at 536. In some embodiments, it is determined whether the success rate is zero at 536. A zero success rate implies that no other service engines recognize the flow. If no success indicators have been received, the rate limit is significantly decreased, at 538. For example, the rate limit may be halved. In some embodiments, multiple comparisons may be made at 536. For example, if the success rate is greater than zero, then the success rate is also compared with a fraction of the rate limit at 536. If the rate limit is less than a particular fraction of the rate limit, such as 1/16 of the rate limit, then the rate limit is decreased less drastically at 538. For example, the rate limit may be multiplied by ?. Other fractions or the rate limit may be used as the threshold and the rate limit may be decreased in another manner. At 538, therefore, the rate limit is decreased in response to a low success rate. If the success rate is not at or below the thresholds, then the rate limit is unchanged, at 540.

Using method 500, the rate limit for flow probes is dynamically updated. As a result, the maximum rate at which flow probes may be sent by a service engine is increased or decreased based upon the success rate. In some embodiments, the rate limit is increased for sufficiently large success rates. As a result, connection drops and other undesirable behavior may be reduced or eliminated. The rate limit is decreased for sufficiently low success rates. The system may thus be protected against unwanted intrusions. Consequently, performance and security of the system may be improved.