FYI: This is how a DNS attack reply profile looks like...
(Seen via AMPR gateway, as someone uses YO addresses as the reply address)
The reply amplification can be nicely seen for each attack sequence – targets are some
hosts in China.
http://www.yo2loj.ro/files/dns_attack_replies.png
73s de Marius, YO2LOJ