Comment by wasipwned

Circling back, this discussion thread seems to be the most likely culprit. In my panicked state, I didn't even consider multicast traffic being the reason why I saw this traffic in tcpdump. I'm digging into this a bit more. I probably wasn't pwned, but I am still currently operating as if I were. I appreciate everyone's response here.