I've been looking at the network traffic and noticed a lot of calls from one machine to an address I'd never heard of:
Information on this seemed somewhat sketchy until I spotted this page on Multicast Addresses
18.104.22.168 All systems on the local subnet.
What? All the machines on my local network? Really?
Pinging it confirmed this:
$ ping all-systems.mcast.net PING all-systems.mcast.net (22.214.171.124): 56 data bytes 64 bytes from 192.168.1.136: icmp_seq=0 ttl=64 time=0.103 ms 64 bytes from 192.168.1.153: icmp_seq=0 ttl=64 time=14.788 ms 64 bytes from 192.168.1.120: icmp_seq=0 ttl=64 time=239.376 ms 64 bytes from 192.168.1.162: icmp_seq=0 ttl=64 time=256.191 ms ... 64 bytes from 192.168.1.119: icmp_seq=1 ttl=64 time=50.762 ms
The machine accessing
all-systems.mcast.net is running a DLNA server, so it appears to be broadcasting its presence to all the machines on the local network. Panic over.