jtara - 8:43 pm on Jan 16, 2008 (gmt 0)

Have you examined this traffic in detail using a TCP/IP data logger?

If your host is not overly-burdened, you can run a data logger on your host. Otherwise, you can run it externally (hardware device or software). In that case, you will need a managed switch, and will have to set it to duplicate traffic from you server's port onto the logger's port.