The purpose of the exercise is so we can learn all of the RPC patterns. From the ident return either a NAT'd Linux box or a Windoze box. I've been getting these for days to the same host. At first glance I thought it was traceroute, but the dest port isn't changing and the packets feel a little heavy. Attacker scanned 200.231.196.11, while spoofing my addresses, and they sent out a rst packet.
Quick oddball scan using different tool, or same attacker using different options.
Some of these networks do not exist, so I am quite certain this is abnormal traffic. My sniffer stuttered a but under the load, which in addition to packets that didn't find their way, could account for some of the gaps. Either they are on a mission to find ports 1685 or 1540, or they are scanning several hosts at once, spoofing my IP's for cover, and scanning for ftp, telnet port 10 and port 12 destinations. I think this looks more like a reset scan than results from a spoofed scan against the source addresses. The occasional syn-ack packets are a little strange, perhaps they are running multiple instances of the scanner with different settings.