I don't think TEREDO is working correctly. It is filling up the known_services.log with entries for local host ports that I know are closed just because there was a TEREDO packet sent to that port.