Another edge case that you might hit is if a host has both IPv6 and IPv4 address (and only really have IPv4 connectivity due to firewalls etc). Running "lsof -p (pid-of-flood-process)" on the agent box and seeing "SYN_SENT" was the clue here.
... View more
