sudo pfctl -s allThe rdr pass entries might be of interest.
You can then use tools like lsof and pstree to find out more ie; lsof iUDP:53535 -n -P
Config can be flushed with sudo pfctl -f /etc/pf.conf
How can I view macOS network filter rules?
In which I pour over some routing tables