not your typical : BAD-TRAFFIC tcp port 0 traffic portscanning?

anyone else getting this? same 'destination' ip
121.35.241.129.  several
'destination' ports, 8000, 80,53.

I have seen this at several clients sites, (same
'destination') but
different 'source' (client is always source)

Any idea what they are doing? Trying to portscan? Looking
for some
vulnerability with 'dest port' 0?
  

05/25-09:22:49 TCP 121.35.241.129:8000 --> 
xxx.xxx.xxx.xxx :0
[1:524:8] BAD-TRAFFIC tcp port 0 traffic
[Classification: Misc activity] [Priority: 3] 


------------------------------------------------------------
------------
------
#(2 - 738314) [2007-05-25 07:43:37] [snort/524] BAD-TRAFFIC
tcp port 0
traffic
IPv4: 121.35.241.129 -> xxx.xxx.xxx.xxx
hlen=5 TOS=0 dlen=40 ID=51608 flags=0 offset=0 TTL=238
chksum=35950
TCP: port=80 -> dport: 0 flags=***A*R** seq=0
ack=759384068 off=5 res=0 win=0 urp=0 chksum=50032
Payload: none
 
____________________________________________________________
_____________
This email has been scanned and certified safe by
SpammerTrap(tm).
For Information please see http://www.spammertrap.com

____________________________________________________________
_____________
_______________________________________________
Bleeding-sigs mailing list
Bleeding-sigsbleedingthreats.net
http://lists.bleedingthreats.net/cgi-bin/
mailman/listinfo/bleeding-sigs