We are seeing very high SYN cookie usage on our LTM forwarding virtual server and the SYN cookie status on this virtual server shows full-hardware. Here are some stats from the virtual server showing the very high usage.
HW Syncookies Generated 109.7P
HW Syncookies Detected 237.7M
Is there any way to determine what host or IP is causing this very high usage using tcpdump or some other method?