Yes, the re-writes are done on a ubiquiti edge router. The re-write rules count the number of hits, as well as basic connection details like src port/addess, dst port/address, protocol. The biggest offender is the roku, which tries to use 8.8.8.8
edit: to be honest though, I don't look at the logs often to see what else gets caught, or why
edit: to be honest though, I don't look at the logs often to see what else gets caught, or why