In reply to Curt Wilson.

Hi Curt,

It's entirely possible there is a buggy load balancer out there that uses TCP source port 0. We do normally see a low level of background traffic using this port (note the dots below magnitude 20). The difference here is simply the amount of traffic involved. Yesterday I updated the post with the fact that the majority of the traffic is destined for TCP port 445. You may realize this is the SMB/MSRPC port for Windows - one of the largest remote attack surfaces out there. It's likely that this is someone looking for windows machines at specific versions/service packs or even boxes that have already been compromised by a specific piece of malware.

Thanks
Craig