Are you able to do any tcpdump / ngrep on your network to see what happens?