On 15/07/14 17:29, donotreply at projectumbra.com wrote: > What is quite odd is: > > This happens everyday at 3AM local time > It happens with 5 IP addresses > The 5 ips all belong to Dell. I wonder if this is being triggered as a result of an ICMP error, in response to a DNS query. Maybe the DNS query happens at 3am (automated job?) which explains the timing. Maybe try running a tcpdump ring-buffer capture and look at the traffic for that time period.