Did you find any thing like that in /var/adm/messages
kernet:Warning possible SYN flood from 203.13x.xxx.xxx
on 207.169.xxx.xxx sending cookies
quite a no of messages were there
Received on Sat Feb 21 1998 - 00:06:12 MST
This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 16:38:56 MST