Nmap Hackers: Best guesses to the Mystery Scan

[Lance Spitzner <lance () spitzner net>]

Several days ago I posted about a mystery scan I 
received.  Since then I have received alot of great
input as to what it might be.  I've compiled the 
results and have done a writeup of what our best
guess is.  Basically, it looks like some default
tools in the Libnet distirubtion were used (kudos
to Simple Nomad and Aaron Campbell for making
the call).  For more info, check out the writeup
at http://www.enteract.com/~lspitz/scan.txt.


Note, the response and help I received on this
was incredible, thanks!  For giggles and grins,
I will be posting new tool/scan signatures on
my website every Monday.  The security community
gets to guess the tool.  I will then post
the results every Friday.  I figure it is a great
way for us all to learn.  More at
http://www.enteract.com/~lspitz/papers.html

Once again, thanks!

lance