Very High SYN Cookie Usage

We are seeing very high SYN cookie usage on our LTM forwarding virtual server and the SYN cookie status on this virtual server shows full-hardware. Here are some stats from the virtual server showing the very high usage.

HW Syncookies Generated     109.7P

HW Syncookies Detected       237.7M

Is there any way to determine what host or IP is causing this very high usage using tcpdump or some other method?