[rupellohn]

Could this have been the result of an NTP amplification attack? https://www.us-cert.gov/ncas/alerts/TA13-088A

[moxious]

Article said no, because the traffic was symmetrical and not lopsided. If this had been part of an attack you'd expect to see far more outgoing bandwidth than incoming.