My servers appear to be targeted by a SYN-flood attack. Between 50-600MBit/s, spoofed IPs.
Packets look like this:
IP p.q.r.s.1234 > my.ser.vers.ip.80: Flags [S], seq 0, win 5840, length 0
p.q.r.s apparently being random. (yes, source port is always 1234)
While this alone is not enough to fill my link, the responses play their part as well and the machines becomes pretty slow.
Is it reasonable to drop TCP SYNs with seq=0?