A server on a packet network is protected from attack by flooding SYN messages that request a connection by comparing the number of SYN messages received within a preselected time interval N, where N is a number SYN messages within said preselected time that, with a predetermined probability, can be considered to be bona fide. When the number of received SYN messages within the preselected time interval is greater than N, corrective action is taken, such as discarding all SYN messages above the received N messages.