[The Real Slim Shady]

In wireshark:
src ip target ip protocol src port>target port

So ... something on 192.168.2.104 is sending all that trafic randomly, this looks similar to
nmap -sS 192.168.1.x but random targets...

So is it DDoS? I don't think so...

[edit] But I am still not sure, could you please share the cap file with us? (in case you still have it)...

Thanks

You're right... I dont think he's being ddos'd directly. The source ip and source port of the transmissions are of his server... the destination are all external. they're also all different. its not a targetted attack on someone so i would rule out being used as slave to DDoS.

There is definitely something suspicious. I dont know anything about a CSS server though so I cant say much about it, but perhaps someone has compromised it? or its misconfigured in some way? that many consecutive rst packets seems to be odd though. something is clearly not right