Abstract: DOS(denial\|of\|service)/DDOS(distributed denial\|of\|service) network attack no t only causes harm to attacked target, but also disturbs other flows that share the same network with attacked target. By adding computing into every bosom node (route, switch), a mechanism system to recover and control DOS/DDOS attack which based on active network was advanced. The mechanism system was composed of three mechanisms: cluster-based automatic identification and control mechanism, cluster-based active notify trace mechanism and administration domain based control cooperation mechanism. Cluster-based automatic identification and control mechanism included identification policy of attack cluster and rate-limit policy of controlling them. Cluster-based active notify trace mechanism will notify the characteristic of attack cluster to upstream active node and activate local rate-limit policy. Effective recovery and the control o f DOS/DDOS attack can be realized by using this system at lab.