SYN Flood attack with sequential destination ports?

I am working with some folks at a partner network who are seeing a SYN flood
attack to a single destination address.

The interesting characteristic is the destination port is sequential - each
phase of attack starting at 3039 and ending arouind 34431.

I checked the source for synful.c, syn4k.c and a few others - all seem to
use a random or fixed destination port. Any ideas on what tool this could
be?

Thanks.

-Joshua Wright, GCIH
Joshua.Wright_at_jwu.edu

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
Received on Nov 08 2001