Port 7000 (Apple File Share) DoS/DDoS underway

["David Gillett" <gillettdavid () fhda edu>]

  A handful of machines, nowhere near me (network prefixes
218, 211, and 61) seem to be sending a mix of SYN-ACK and
RST packets, all with a source port of 7000, to assorted
(random) addresses in my public Class B range.

  I expect this means that someone is spoofing random source
addresses -- many of them in my range, but who knows how many
in others... -- and ports and SYN-flooding those half-dozen
machines.

  So far, reverse DNS and traceroute haven't helped me identify
the victims.

Dave Gillett