I am logging unsolicited packets from "outside" our LAN via iptables:

....
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i ! eth0 -m state --state NEW -j LOG --log-level 7
--log-prefix UNSOLICITED:

When I parse the log file, I am occasionally finding --state NEW UDP
packets from 148.78.149.20[0123] SPT=53. The first 2 of those addresses
are the nameservers of record, and:

$ cat /etc/resolv.conf
nameserver 148.78.249.200
nameserver 148.78.249.201

My question is: Why would a nameserver send me a --state NEW packet,
especially originating from port 53 where DNS requests are listened for,
and why might those other 2 addresses be involved?

I'm sorry I can't figure out how to add a Followup-To: header using this
Evolution newsreader.