I don't know very much about defending against DDOS attacks. How do you identify a SYN flood and filter it without interfering with legitimate traffic?