...

We most frequently are the zombie/reflector participants in an attack that originates outside our network, to a target outside our network. As many as 8,000 hosts on our network are reflecting SYN floods in the current attacks.

I finally found a paper on this type of attack.

You might also try: "An Analysis of Using Reflectors for Distributed Denial-of-Service Attacks," V. Paxson, Computer Communication Review 31(3), July 2001. http://www.icir.org/vern/papers/reflectors.CCR.01/index.html http://www.icir.org/vern/papers/reflectors.CCR.01.ps.gz http://www.icir.org/vern/papers/reflectors.CCR.01.pdf - Vern