I'd recommend only really addressing the most obvious attacks, rather than trying to follow up on everything that even looks like it. I once got an "emergency"

I'd recommend only really addressing the most obvious attacks, rather than trying to follow up on everything that even looks like it. I once got an "emergency" call at 7am (I had been up doing something rather late), about a machine I run attacking this guy. After some digging with him, the machine was our public-service NTP server, and the packets were on udp/123, in response to packets his system was sending out. Ended up with him yelling at me and hanging up, and me shutting down our public NTP server for good.