right >.< sorry. But at least we can both agree that that traffic is DNS so we can proceed accordingly Can you post some of the DNS queries that are being made? That would shed a lot light on the situation.