when you run : netstat -an |grep :80 |more but with several hundred of them, not five :) Assuming your kernel was built with syncookie support, type the following as root. echo 1 > /proc/sys/net/ipv4/tcp_syncookies If it's not enabled, there isn't much you can do other than build a new kernel and reboot and use it or wait out the attack,