Security Incidents: XMAS scan

["E, M" <freehold () EROLS COM>]

Yesterday one of the babies announced that it had denied a 'probable'
XMAS scan.  Considering that the presumptive origin is a .mil/80 (to
LAN/42932) and that XMAS theoretically doesn't work on NT because of the
all-flags-set (so why bother except for an implied result).....I'm
wondering if anyone has had any experience with this 'alert' being
triggered by, say, a router with either a sense of humour or a hangover,
instead of an nmap-happy curious george.  :)

TIA for any feedback/explanations --

Missy