FYI: This is how a DNS attack reply profile looks like... (Seen via AMPR gateway, as someone uses YO addresses as the reply address) The reply amplification can be nicely seen for each attack sequence – targets are some hosts in China.
http://www.yo2loj.ro/files/dns_attack_replies.png
73s de Marius, YO2LOJ