>> Application layer DDoS attacks , in most (all?) cases require a valid >> TCP/IP connection > DNS query-floods are a notable exception. may i remind you of the dns query flood i had which you helped research? udp and tcp, from the same sources. randy