I'm having similar problems, though slightly different. My firewall is sending me multiple warnings every day that IP spoofs are being attempted. They're false positives, however, because they originate 127.0.0.1 and CA is their destination (I'm presuming this is during signature updates).