An observant reader noticed a fairly dramatic upswing in scanning for UDP/7100. This port is noted as being the X Font service.

More recent graph can be seen here.

Got packets? Got theory? Got sploit? Got malware?

Cheers,
Adrien de Beaupré

Update 1:

http://blogs.zdnet.com/security/?p=556
Solaris worm/bot?

Update 2:

The X Font Service runs on TCP.
P2P?