http://jprs.jp/tech/notice/2006-03-29-dns-cache-server.html

iptables -A INPUT -p udp -m string --hex-string "|03697363036f726700|" --algo bm --to 65535 -j DROP

dig @a.root-servers.net . ns > /var/named/named.ca