Could be a new worm. Can you perhaps set up a sniffer and capture some of the offending packets?