A server on a packet network is protected from attack by flooding SYN
messages that request a connection by comparing the number of SYN
messages received within a preselected time interval N, where N is a
number SYN messages within said preselected time that, with a
predetermined probability, can be considered to be bona fide. When the
number of received SYN messages within the preselected time interval is
greater than N, corrective action is taken, such as discarding all SYN
messages above the received N messages.