Thank you for your insight. A bogus IP - one that no one is listening on - would also not ACK a RST, right?
Doing a little googling this process seems to detect an attack (from a valid ip) that has been programmed to ignore RST - presumably because some intermediate ISPs (like tier1 borders) will detect a DDOS and forge a RST to attempt to mitigate them. Much like the firewall configs that circulated to defeat sandvine RST throttling of bittorrent.
A bogus host will obviously not respond to the RST but the last router-hop that receives the RST will (per RFC/protocol specs). The response is destination unreachable via ICMP. The ICMP unreachable packet is cheap (non-persistent) and requires no up-keep from the last hop to the bogus host. Most importantly, the ICMP unreachable packet requires no upkeep from the filtering node in EC2.
Doing a little googling this process seems to detect an attack (from a valid ip) that has been programmed to ignore RST - presumably because some intermediate ISPs (like tier1 borders) will detect a DDOS and forge a RST to attempt to mitigate them. Much like the firewall configs that circulated to defeat sandvine RST throttling of bittorrent.