Lots of traffic in /tmp on intro detection