Hacker News Reader

You are missing something. You are seeing BGP routing table updates on your network from an AT&T router. You have BGP running on your network somewhere.

You can run the below command to see which process or PID is talking over ipsec-nat-t

sudo lsof -n -i :4500

That's often true, but not always. For example, if your desktop is connected to an Ethernet hub, you would usually expect to see all traffic from any machine on the hub. (Ethernet switches are a different story.)

Wi-Fi can work the same way, though it sometimes requires an extra step to place your machine's network card into "promiscuous mode" in order to see traffic neither to or from your machine.

I had run lsof on my desktop and I did not see any of the IP addresses in question. I did not check specifically for port 4500 though.