Would you be willing to share some good resources for identifying rework traffic beyond IP? I have seen things in my little snitch logs I wonder about but no real recourse.

And I'm guessing most of the time the "thousands of ways" don't all point in the same direction.