Spoofed IP port scan?

[Dave Chen <Dave_Chen () ACML COM>]

Hi,

         I notice an increase in scanning for sunrpc, telnet,
ftp, etc for a range of IPs (that include our hosts in that IP
range).  I've notify the ISP of the source address.  One ISP
stated that they could not find the corresponding activity in
their external router, indicating the IP could be spoofed.
         Question:  If the IP is spoofed, how can the hacker get
the port scan information?  They either have to be on my up
stream ISP or the up stream of the source IP to the scan results,
right?

Dave Chen CISSP