First, I'd like to thank the innumerable people who told me about tcpdump.
(I have to be more creative with 'apropos' keywords...)  Next, "greywolf"
wrote:

> Heard a rumour that there's an extremely hacked version of csh out there
> which makes use of icmp as a transport layer.  You might want to run tcpdump
> and take a look.

I knew it was ping because (a) the regular once-per-second receive/transmit
pattern was quite obvious, and (b) netstat -picmp told me that the number of
ICMP ECHO and ECHO REPLY packets was growing at about one per second.  It
turned out to be a friend who had started a ping and then had that window
close spontaneously without killing the ping...

(Surely you mean "rsh" rather than "csh"; and I think you'd want to use a
bogus ICMP packet type rather than ECHO, to ease sorting out the desired
traffic.)