SYN Flood attack with sequential destination ports?

[Joshua Wright <Joshua.Wright () jwu edu>]

I am working with some folks at a partner network who are seeing a SYN flood
attack to a single destination address.

The interesting characteristic is the destination port is sequential - each
phase of attack starting at 3039 and ending arouind 34431.

I checked the source for synful.c, syn4k.c and a few others - all seem to
use a random or fixed destination port.  Any ideas on what tool this could
be?

Thanks.

-Joshua Wright, GCIH
Joshua.Wright () jwu edu

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com