Lately I have a lot of domain response traffic from china, probably a dns amplification attack targeting the host 42.202.148.15. The used address which gets that traffic is mainly 44.182.20.27. Other hosts of this subnet also receive traffic via the ucsd tunnel (44.182.20.*, 44.182.230.*).
These addresses have no registered host name and thus should be dropped by the gateway, but this is not happening.
Anyone knows an explanation or is it a gateway bug?
Marius, YO2LOJ