I have sometimes a slow kind of attack (plus minus 15.000 a day) on port 80 and I block those with an address-list. I filter on the sync and that works good.
Today a saw an address from china (140.143.1x.xx) that could made a connection (SAC) on port 80 which don’t reach the webserver and I think it is filtered before by content filters.
I added it to my normal block address-list but it was not filtered so I turned on Wireshark. I get first a RST,ACK,CWR packet and then a SYNC,ECN,CWR and then a RST or ACK from that address. The webserver does not reply to those packets so they are only kept in the connection table of the router.