[mfukar]

In that case, the source/destination IPs would not resemble backscatter traffic. Unfortunately, SANS forums aren't much for analysis..