They are sending it now as a stream so it seems not to be closed. Try this in RAW and see if that stops the attacks: psd (integer,time,integer,integer; Default: ) Attempts to detect TCP and UDP scans. Parameters are in following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight ...