The result, he said, was "foundation shaking."
His sniffer reported unwanted connections to spooky corners of the Interweb such as "DoD Network Information Center (Department of Defense)" and "Halliburton".
"I ran traceroutes on the IPs," writes the informant who unfortunately outs himself here.
"Sure enough they came back legit and government owned. I thought this might be exclusive to my system, so I ran over to a friend of mine who upgraded to Vista when it first became available.(...) After installing monitoring software on his system, the hits it caught on his network were immediate and almost identical in source."
He says he detected a "Ministry of Defense Data Return Agent" and one source he investigated, "DOHS-Recon" seemed, to be blocked on traceroute.
"Many of us who are monitoring this situation have suspected the acronym stands for the Department of Homeland Security *Reconnaissance?*. This is merely a guess, but an educated one at that," he says. Gulp.
Sign up for INQbot – a weekly roundup of the best from the INQ