I don't know, but since nobody else seems to either, how about a
router box that detects excessive SYN activity and then automatically
blocks that ip address for awhile? I suppose it just means that
the attacker has to vary the source address rapidly.