suggest you runner a sniffer (e.g. wireshark) to see exactly what is going on. I suspect the traffic is to some *unix box(es). Services (e.g. xinetd) on *unix boxes typically dynamically allocate...