Thanks for those links - support couldn't provide them. we experienced activity similar to the one in 48407:
<foobar ~> sudo tcpdump -i eth1 'host toaster1'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
00:17:50.276938 IP foobar.40047 > toaster1.ssh: Flags [S] [...]
00:17:50.277795 IP toaster1.ssh > foobar.40047: Flags [S.] [...]
00:17:50.277813 IP foobar.40047 > toaster1.ssh: Flags [.] [...]
00:17:50.278732 IP toaster1.ssh > foobar.40047: Flags [F.] [...]
00:17:50.279027 IP foobar.40047 > toaster1.ssh: Flags [F.] [...]
00:17:50.279842 IP toaster1.ssh > foobar.40047: Flags [.] [...]
Since this is a minor-rev upgrade, we would be able to do it without taking down the cluster. Let us know how it goes and if you continue seeing symptoms;