December 1, 2017 at 09:05 PM PST I suspect that NTP traffic was the trickle of traffic that traversed my recently decomissioned NAT permalink