Most questions like these never seem to get a satisfactory conclusion posted to a forum. So, just to totally close this one down and to add a warning to everyone. I run a raspberry pi as a simple web server and cctv camera system. As this pi is not normally visible to the internet it runs defaults.
Rule 1. Always, always change the defaults regardless of how safe you think you are.
Anyway, I temporarily opened up port forwarding on the router for SCP to test some file transfer software; the port was open for just a few minutes but this was long enough for an automated bot to find my pi and install itself into the local RC folder as well as changing the user pi password and then rebooted to become a new bot.
The bot code uses zmap to continually scan the internet looking for open raspberry pi machines. That's bad enough but as a side effect it uses up all the router's available ip sockets which caused the symptoms I was seeing.
Once the problem was identified it was simple to clear up.
So , moral of this is ALWAY change your defaults and think carefully of the ramifications of opening up your home network to the internet.
