add DNS reflection example (incomplete)
suport query configuration from bind9 querylog
DnsPacket for spoofed DNS query (amp attack)
support node definition from querylog data