Real-time DDoS detection by stitching a FABRIC slice to AmLight via an FIU facility port and orchestrating L2VPNs with sdxclient (AtlanticWave-SDX). A P4 switch tracks packet counts and source/destination IP addresses in registers and emits digests; the controller aggregates features, ranks candidates, and installs mitigation rules via P4Runtime. Streaming stats (e.g., mean, stdev, unique sources) feed a lightweight ML model to classify flows as normal vs. attack, yielding a reproducible workflow for P4 analytics on live AmLight data. Cover VLAN binding, P4Runtime updates, digest streaming, and lightweight ML classification, yielding a reproducible pipeline on AmLight-connected research networks.