Hi Craig, Martin. I seem to recall that source port 0 traffic was sometimes also seen in certain load-balancer scenarios, but I cannot recall the details on this as it was many years ago that this came across my radar while researching scan activity at a university. Considering the "sore thumb" that source port 0 traffic is, do you think that some attempt at fingerprinting network infrastructure was also performed and was there any other unusual element to the scanning traffic?

Thanks & Cheers,
Curt Wilson