Filter obviously useless source IPs

[tvdhout]

Obviously spoofed IPs used in non-reflective attack vectors should be removed from the attack vector to avoid fingerprints with millions of source IP addresses in e.g. TCP SYN attacks.