Comment by yabones

Was it IPsec traffic, or just something running on the IPsec port?