[m463]

gah, I remember once when I was working at a company, and we got an email complaining "stop hacking my systems!"

in the end, we had a load-balancer at .1 balancing a bunch of backend servers.

the complainer would have traffic to .1 that the load balancer would receive. Thing is, old or stale connections would drop out of the load balancer mapping table, and eventually the backend server connection would not get mapped, and the guy would get traffic direct from the backend server real ip address.

the traffic was actually generated by the customer, but these "unrelated" backend servers looked like they were hacking him.