While running Wireshark trying to troubleshoot some other issues, I noticed several SYN connections to ports 80 and 443 on the workstation I was using. The packets were dropped. These were coming from other workstations. There is no webserver running on this workstation, and its IP address has been the same for weeks.
Running process monitor on one of the source workstations, I found Firefox is the source of the packets.
Anyone know why Firefox would be attempting to connect to another local workstation, not a server? The workstation is running Firefox 39.0.
Edit 08/12/15: I stuck apache (via xampp) on the "victim" computer and found the very common log entry
"/connect/xd_arbiter/7tUlZKGPU61.js?version=41 HTTP/1.1" 404 1354 "(some webpage)" "(useragent)". Google tells me this is something to do with Facebook, but nothing really beyond that. Does anyone know more?