Feel free to ignore the python script, looked handy to me.  The path is very helpful for cronning our update script

BTW -- I have an interesting attack, I'm not sure what to do with.

9:08:39.851673 IP 183.60.133.43.7055 > 184.XXX.XXX.XXX: 42370+ [1au] RRSIG? doc.gov. (41)
	0x0000:  4500 0045 52fc 0000 fa11 cedb b73c 852b  E..ER........<.+
	0x0010:  b8ad a9ba 1b8f 0035 0031 0000 a582 0100  .......5.1......
	0x0020:  0001 0000 0000 0001 0364 6f63 0367 6f76  .........doc.gov
	0x0030:  0000 2e00 0100 0029 2328 0000 0000 0000  .......)#(......
	0x0040:  0000 0000 00   

Its a legitimate domain - I don't want to block doc.gov.  Thinking it would be good to modify the script to have a limit target instead of just dropping all the time.  Then the master list we would need to have a way to distingish definate attacks from maybe attacks.  Thoughts???