> So the issue is to figure who is sending the UDP packets without an > associated TCP session. If a client is afflicted by NAT, especially CG-NAT, it's possible that separate connections may appear to come from *different* IP addresses. Some NAT setups have a *pool* of public-facing addresses. -- dwmw2