want to protect against Etherhiding? it's still in use by the originator of the technique #ClearFake along with others like ErrTraffic. if you can, add these bad boys to your DNS filter.
https://gist.github.com/rmceoin/cb18addf7f7515daaf5191540885d931