FIN scan on port 23 from 207.253.223.19

[razor () LDC RO (Alexandru Popa)]

I noticed a FIN scan on port 23, but the interesting part is that it seems
to scan a rather large number of hosts. I noticed this on 2 class C's,
x.y.146.0 and x.y.213.0 (x and y are the same)

Logging is different, one came from the firewall on one net:
(sorry, probably wrapped)
Feb 13 22:17:26 ?!? kernel: Packet log: some_chain REJECT eth2 PROTO=6
207.253.223.19:47850 x.y.146.1:23 L=40 S=0x00 I=3329 F=0x0000 T=231
(#21)
Feb 13 22:17:26 ?!? kernel: Packet log: some_chain REJECT eth2 PROTO=6
207.253.223.19:47850 x.y.146.2:23 L=40 S=0x00 I=34051 F=0x0000 T=231
(#10)
Feb 13 22:17:26 ?!? kernel: Packet log: some_chain REJECT eth2 PROTO=6
207.253.223.19:47850 x.y.146.3:23 L=40 S=0x00 I=36865 F=0x0000 T=231
(#10)
(and so on...)

The other one is from a tcpdump I redirect to the harddrive on my home
cable box. The date is the same, both computers use NTP for sync:
22:41:36.117817 207.253.223.19.47850 > x.y.213.z.23: F
3780116480:3780116480(0) win 512
22:41:36.118071 x.y.213.z.23 > 207.253.223.19.47850: R 0:0(0) ack
3780116480 win 0

Note: the last one was during a load of ARPs from the default gateway,
requests for x.y.213.2, x.y.213.3 and so on, ending on x.y.213.254

------------+------------------------------------------
Alex Popa,  |There never was a good war or a bad peace
razor () ldc ro|                   -- B. Franklin
------------+------------------------------------------
"It took the computing power of three C-64s to fly to the Moon.
It takes a 486 to run Windows 95. Something is wrong here."