From: "Forrest W. Christian" <forrestc@iMach.com>

5 minute SYNS: 123423 5 minute SYN-ACKS: 50000

Then, if the ratio got too high, it can start yelping about "Potential SYN D-O-S Atttack in progress on Interface Serial 1"

I suggest to check not only ratio (assymetric routing !), but high number of SYNs to single host. - Leonid Yegoshin, LY22