I've been reading around a bit, and everything I can find on this signature points to Linux hosts. In my case, this sig is firing as Atacker=W2K3 DNS server in my DMZ. It's our outside DNS server (SOA). So far - I can't find any reason NOT to be conc...