Interesting, it's all upload too. I've seen a "smart" device that just blasted out NTP packets to an unresponsive server in an infinite loop. I wonder if something like that is happening there too. That's too much data for NTP though