Any good hacker will spoof the source in addition to using several different machines that may only be under his control due to their own compromised security. Reverse-tracing the IP address is almost always a fool's errand unless you've got significant chops as a hacker yourself.
I don't have a solution myself, but most software firewalls should allow rules that specific types of connections or connection attempts be dropped. Because it is still the software dealing with this, inspecting incoming packets and matching them against the rules, this will not drop the load completely off the server.
Which brings me to a final point: Why are you not using a hardware firewall in this setup? If this is a server touching the public internet it needs a seperate firewall device. Period.
UPDATE additional possibilities:
Depending on the sort of agreement you have with your ISP, they may be willing and/or capable (for a price) to perform packet inspection/traffic shaping and firewall duties for you. Their systems are probably pretty capable of this. The problems would be that you'd never see if legitimate packets were being dropped. This is a lot like spam. The best DDoS attacks are the ones that look the most like legitimate traffic. And if you start losing customers or contacts due to overly aggressive firewall rules that you don't get direct control of (ie, rules on your ISP), it may hurt worse than the DDoS.
If you absolutely cannot use a hardware firewall you should at least give them a call.
bandwidth SYN spoof
attack. In that question I learned how to usenetstat
command and after checking IP addresses I find it is a spoofing attack. Now this is a question about the solution for a known attack not finding the attack type.