I did the things you mentioned before posting on here, they didn't disclose any apparent issues. I actually did a tcpdump of all traffic for a good timeframe before and after what's posted, but only posted the relevant output here for compactness.
Is there something I can turn off to disable checking in the first place? Thanks for all the info --Dmitriy