Consider running http://www.wireshark.org/ to get a complete trace of all the packets when you notice it happening.
Then isolate and forward the sshd related packets to your ISP.