On Fri, 02 May 2008 12:37:18 +0000, Andrew Gideon wrote:

> Perhaps the issue is that responses are coming from different IPs than
> that to which the requests are sent?

Thank you, I think that is the most likely scenario, as /etc/resolv.conf
on all NAT'd machines lists 148.78.249.20[01] and the occasional
"unsolicited" UDP packets emanate from SPT=53 on 148.78.249.20[0-3].

I'll use wireshark to examine the traffic and verify that hypothesis if
possible.