Comment by muststopmyths

Not familiar with NFS, but shouldn't it have been possible to attribute the mystery traffic by port number by sniffing ?