I agree, both 'sides' to this story share a little responsibility You would think someone watching logs so diligently would also note the counters for dropped

I agree, both 'sides' to this story share a little responsibility You would think someone watching logs so diligently would also note the counters for dropped packets ceasing, and probably look to remove the rule Because well, they use DHCP. Those IPs by very nature of that environment are not static.. so rules dropping them shouldn't be either. Maybe just accept that services get unwanted traffic and QoS and structured logs exist for a reason. This is like early optimization, good intentions leading to holes in feet. I can look past it though for benefit of the story. The person flipping power had far more reasonable options at their disposal... Though I doubt they would expect a problem specifically with their source IP - a bit rigged