However, it seems unlikely that ALL of the connections that the original poster detected would be ad hoc, surely some of them must be internet connections?