Tons of unknown connections in nethogs

I am seeing hundreds of different connections to the same ip and port scrolling by when running nethogs. Occasionally the foreign IP and port will change (not always 80, but sometimes). I've noticed that my router CPU usage jumps to 100% when these huge bursts of connections happen, so I'm fairly certain that this massive spike keeps overloading the router and essentially making my network useless for up to a full 60 seconds. Things I've tried: - sudo netstat -tulpn | grep $whateverip: nothing - sudo netstat --inet -ap | grep $whateverip: nothing - sudo lsof -i | grep $whateverport: by the time this finishes, the port and IP have changed again This may just be paranoia, but I swear it seems like every time I try to dig into more info on the connection, the port and IP change, so my command gives me nothing. Am I dealing with something evil living inside my server? Or is there some more benign explanation that I'm missing in my limited networking knowledge? Also note that this is an Ubuntu server with no UI, so it's not me chasing around someone just browsing reddit.