Not sure whether I should be posting here or backups or somewhere else but
perhaps someone could point me in the right direction.

I was reviewing the packet logs on our BM server and saw that starting on
Jan 4th our main NW65 server (NDS master, DNS) which is also our BE media
server (BE9.1) started trying to contact an external IP address at 19:02
each evening, until 19:15 on port 524. Our nightly backups kick off at
19:00. The ip address in question appears to belong to a French company,
but doesn't appear to be alive. This activity has continued at the same
time each weekday since, but stopped at the weekend. We run a full backup
Mon to Fri and then we just backup a secondary server on Saturdays, which
might suggest why this activity varies between weekdays and weekends. I'm
somewhat at a loss as to what may be causing this behaviour, it was just
the timing that made me think it might be backup related. I haven't made
any changes to the backup configuration (or indeed anything else on this
server) since the start of the new year.

Any ideas as to how I can investigate this one further would be gratefully