[wasipwned]

So interestingly, it looks like Unifi did classify the traffic as wifi calling, but it was doing a lot of traffic in the middle of the night when I was asleep. And the biggest question mark in my head is: how is this traffic looking like it's coming from my desktop?

[veonik]

WiFi calling is multicast, I think, so your phone just basically broadcasts it to the network and every device will see it, though only your router will actually do anything with it.

There's examples of WiFi calling causing this type of issue, described as a packet storm. For example, here's a reddit post with similar symptoms you're describing. https://www.reddit.com/r/networking/comments/3g31mc/iphone_w...

[wasipwned]

This actually makes the most sense so far. I hadn't even considered the possibility of multicast. Let me see if I can dig in further.

[wasipwned]

And by looking it's coming from my desktop, I mean the tcpdump was run directly on my desktop and I saw the traffic there. So I assume it had to be routed through my desktop unless I am missing something.

[FollowingTheDao]

You are missing something. You are seeing BGP routing table updates on your network from an AT&T router. You have BGP running on your network somewhere.

[Kikawala]

You can run the below command to see which process or PID is talking over ipsec-nat-t

sudo lsof -n -i :4500

[valleyer]

That's often true, but not always. For example, if your desktop is connected to an Ethernet hub, you would usually expect to see all traffic from any machine on the hub. (Ethernet switches are a different story.)

Wi-Fi can work the same way, though it sometimes requires an extra step to place your machine's network card into "promiscuous mode" in order to see traffic neither to or from your machine.

[wasipwned]

I had run lsof on my desktop and I did not see any of the IP addresses in question. I did not check specifically for port 4500 though.