So, for the record (and to assert my understanding) it looks like this attack does not use DNS messages or port 53 at all. It happens that the DNS server on windows listens for some RPC/management stuff on a >1024 TCP port, and this is where the attack comes in. Duane W.