[Retr0spectrum]

The second wave is likely when public port scanning services such as shodan re-scan your host. (I wonder how hard it would be to fingerprint and subsequently blackhole shodan et al's scanning traffic)

[fgonzag]

Like an IDS or IPS? Snort is quite decent at that.