I was referring to this particular pattern, src-port 80 dst-port 2183 it's new to us so is some (expletive deleted) testing something new???? agreed spoofed addresses show up all the time in no particular order it's when they take on a recognizable pattern THEN I start to worry... Michael Shields wrote:

In article <38C80DF3.6194803E@bexair.com>, "Scott McGrath" <s_mcgrath@bexair.com> wrote:

...

Has anyone else noticed probes against their network with a spoofed

Sure, all the time. http://www.nfr.net/forum/publications/id-myths.html -- Shields.