Oops, my bad. 27 is the byte size of the packet sent. I've found one
other reference to it on the net at:
http://www.net-kitchen.com/pipermail/suns-at-home/2001-April/000978.html
which shows this packet to contain "unknown source address" as text.
What could be causing this? As my tcpdump output shows, the client and
server know their IP addresses otherwise they wouldn't be named in
tcpdump.