Recently I have noticed an increase in “DoS udp_flood Block” entries registered by my router.
They occur at various times of day and night.
They are coming from 8.26.56.26,53. ARIN states 8.26.56.26 as Level 3 Communications, Inc.

I use Wireshark to monitor my network and extracts provide...
LOCAL0.INFO: Feb 23 10:31:06 Feb 23 10:31:06 gjdpc.router: DoS udp_flood Block(10s) 8.26.56.26,53 -> ??.?.?.??,19999 PR udp len 20 77
(with ??.?.?.?? my IP address, hidden to retain privacy)

I have contacted the company, but in the meantime I was wondering if these are genuine udp flood attacks, or just legitimate background activity (such as banner ad traffic) that I cannot pin down.

Any thoughts please?

---
Specs: Vigor2600 router, Lubuntu 12.04.03 (also Windows XP on another machine), private home network (not a business), Wireshark v1.6.7

if you have performed request of testing dns lookups maybe the router drops the packets so the computer will try again ... i would say is not danger ... it looks like the 8.26.56.26,53 is your dns server

If you have a server running which other people accessing it also can be a case of someone flooding you (maybe don't like your server, other ways why to flood you ) but then if your connection is not going down it may not be the case

I am guessing that they are intrusion attacks. My router blocks DoS udp_flood attacks, so they are not causing my connection to fail.
It is not one of my own DNS servers, the addresses for those are completely different.
Thanks anyway.

Probably this:

DNS Amplification Attacks