The first record looks like traffic on udp/1026 which is used for windows messaging service. Win-rpc is used for windows messenger popup spam.  My firewalls sees thousands of these records too.

As this is UDP it is HIGHLY likely that the source address is forged.

Interestingly a whois on 22.20.228.228 reveals:

OrgName:    DoD Network Information Center
OrgID:      DNIC
Address:    3990 E. Broad Street
City:       Columbus
StateProv:  OH
PostalCode: 43218
Country:    US

NetRange:   22.0.0.0 - 22.255.255.255
CIDR:       22.0.0.0/8
NetName:    DISNET
NetHandle:  NET-22-0-0-0-1
Parent:     
NetType:    Direct Allocation
Comment:    Defense Information Systems Agency
Comment:    7990 Science Applications Court
Comment:    Vienna, VA 22183-7000 US
RegDate:    1989-06-26
Updated:    2001-10-11

RTechHandle: MIL-HSTMST-ARIN
RTechName:   Network DoD
RTechPhone:  +1-800-365-3642
RTechEmail:  **********@nic.mil

OrgTechHandle: MIL-HSTMST-ARIN
OrgTechName:   Network DoD
OrgTechPhone:  +1-800-365-3642
OrgTechEmail:  **********@nic.mil


All destination addresses are based in China, as well as the originating addresses, excluding the DoD address.

The remaining records have a destination of tcp/80.  They are all ACK or FIN/ACKs and are invalid packets.

One reason for a bad/invalid packet is that it is malformed in some way. this could be due to the packet being corrupted in transit. It could also be that the traffic is from out of sequence packets being dropped.

This traffic could be the result of a scan/attack that is attempting to inject a packet by attempting to guess the ISN. This will allow the attacker to take control of the packet stream by completing the 3-way handshake. This could result in compromise. This scenario seems somewhat unlikely though.

This type of attack is common from the location of these IPs BTW.

What services are you running that are open on the firewall?

What exactly has changed in your routing table?

If you think that you have been compromised you might want to look for signs of a rootkit or backdoor.

-dean-