I have 3 Netware 6.5 servers at my site and I have 1 6.5 at a site
connected to us via wireless G link. I have just started seeing an error
being reported in a Cisco MAES that one of my servers here is "attacking"
the remote server. I have had the MARS up for over a month with no events
logged for any of the Novell devices, but since Saturday it is a constant
stream of errors. The server on this side holds the master replica for the
enterprise. The device reporting the error is the router at the remote
site (I have IPS turned on on all of my routers)

The errors are Half-open SYN Attack / SYN Flood Denial of Service. The
detail specifies: "This signature detects excessive concurrent half-open
TCP sessions. A connection is half-open if the client never sends an ACK
packet in response to the SYN/ACK from the server." The source port is
26731 and the 3019.

Any help on this would be greatly appreciated.