Hi dttng - Can you verify they look correct in a packet capture, or try it on a flow from a different device? There have been know issues with some vendors firmware where the IP Address is not getting encoded correctly...
The packet capture looks correct. The flow is coming from a Cisco Catalyst 4500 and it seems like the ip address are transpose between first octet and second octet, third octet and fourth octet.
Can you send a .pcap file via email? Send to my username at solarwinds dot com