In reply to John Spade.

John I completely agree. Once "they" have the data they can conduct the attack from a completely different address space. The proper way to deal with this is by blocking as much of the initial reconnaisance so that you are a less entising target. Port zero traffic is quite easy to block with the firewall or even the IPS.