[Intrusions] unusual activity on IP based ports?

[man at tfhs.net]

i have 3 boxes on same subnet on internet. each box is probed a couple
times per day on a single port from 2 or 3 machines. the interesting thing
is that the port is different for each of my hosts, but always consistent
on that host from one day to the next.

any chance someone has seen some malware that hashes the IP its probing to
come up with a unique port?

allan