Keep your network clean of DDoS participiants
Some network services are predestinated to be used as DDoS helper: They are UDP
based and the response payload is much bigger than the sent request. UDP makes
it easy to fake the sender IP. So anyone can send a request on behalf of some
other IP which then gets