Can we reject DNS request with IP header identification = "0x0000" ?

 

Hi, all

 

I am on POC testing for China Telecom LDNS enhancement cases. By now , customer found mostly DNS DDoS attack come with IP header identification = "0x0000" as attach JPG shows .

 

Sorry , I can't find any iRule function to check IP header identification value , can we use iRule to detect these packets ?

 

 

Best Rgds,

 

Raymond