Packet Read Out Figure 4 shows the normal DNS items. Answers' shows us that the Name goes past end of captured data in packet. This is where the overflows are beginning. The next packet is the victim's reply. In other words, it has no clue what's going on.
Lets take a look at the ethereal output for the next packet.
Once again we can look inside the packet and come up with a great signature. If you look at the ID you will see 'dead'. The reply to that packet looks like this. The next couple of packets we see here show us 192.168.1.5 making a connection with 192.168.1.25. The initial connection is shown in Figure 7.