Hello did you saw this type of attack? tcpdump 22:42:00.565519 83.102.166.7 > 200.123.456.789: udp (frag 53995:25@512) 22:42:20.174143 83.102.166.7 > 200.123.456.789: udp (frag 34877:25@512) 22:44:45.756888 83.102.166.7 > 200.123.456.789: udp (frag 46589:25@512) 22:46:40.741492 83.102.166.7 > 200.123.456.789 udp (frag 4052:25@512) 22:47:02.074045 83.102.166.7 > 200.123.456.789: udp (frag 17141:25@512 -- abraço, Bruno Wallace