Turns out to be IPinIP packets coming from 10.2.2.21. (Spoofed, of course.) The NOC of the network sending 20mb per second of these is hearing from us now. Thanks for all the help.