I was the OP in the Whirlpool post. I use Mikrotik extensively to manage connections and have done for many years. This has only become an issue recently and it has happened enough times now for me to ascertain that it is when there is a Windows 10, or Office 2016 using the new Windows update doing its thing. I have tried to limit the issue by creating limited new tcp connections per second to any given IP address and even limit maximum concurrent connections.I have seen on occasion during this issue occuring a sudden huge burst of new outbound connections. I was thinking this would cause a type of DOS attack with thousands of SYN ACKS coming back.

The real kicker is that the connections are all to servers (Akamai) on port 80, so any serious blocking breaks all web browsing. The cynic in me says the whole Windows 10 update thing has been made to operate in lockdown environments when non-well known ports are blocked. Intentional, or not, the Internet is basically broken while this happens as Windows is ubiquitous and people all over the world who have successfully used inbound rate limiting to create successful shared Internet connections are going to be getting angry support calls. I hope my post goes viral so it starts to get seen by the likes of Microsoft and Akamai engineers. The local ISP I spoke to where I initially noticed this problem pretty much fobbed me off with the old "nobody else has reported the issue."