[xur17]

I experienced a somewhat similar issue yesterday on my network that I described in detail here [0].

Essentially one of the computers (running ubuntu) on my network started sending a VERY high volume (it measured 20gb for the day, and I think it was all over a 10 minute period) of DNS traffic to my router, which runs an unbound instance for my network. That traffic (or at least I think it was that traffic) brought down my network to the point where I could even ping an external or internal ip address.

Does tcpdump show the destination ip address the traffic was sent to on AT&T's network? Curious if that could be a dns server..

Also, what version of ubuntu is your desktop running, and what software does it have on it? Are you using canonical's livepatch service?

[0] https://forum.opnsense.org/index.php?topic=31284.0

[wasipwned]

Yes I posted the IP address here: https://news.ycombinator.com/item?id=33820749 and it appears to be AT&T's CGNAT IP address and communicating over port 4500 (IPsec), so the likely culprit is Wi-Fi calling which uses IPsec.

I'm running Ubuntu 20.04. I don't use livepatch, but I do update/reboot frequently. I'm mostly running Chrome, Firefox, and Docker. Occasionally GIMP and LibreOffice.