Thanks you so much.
I'm not a firewall guy as you can see.
Allready try to blackhole that particulary subnet and traffic is still there.
It's only on the vpls network this is what make me think! I can't see this traffic on routers outside vpls.
Any way, thanks for your time and will