Syslog upon discarding a First/Opening State

[dxflatline]

Hi Forum,

I'd like to share an idea and also ask if it's possible.

We had a DDoS attack on our cluster (~1.000.000 unique hosts) which was practically SYN Flood towards a PAT'ed port
As such, states were overflown –> Downtime.
Regardless of our response to the incident (set aggressive mode / pfblocker etc), I was wondering if pf can inform us with a log upon a discarded connection attempt due to the timeout on the pf.first state..

Of course, I understand we have a syslog during the SYN packet processing, but having the above log stream may allow us - during an SYN Flood DDoS attack - to identify the subset of the attackers and block them earlier in the path.

I would appreciate your opinion on this idea and if it is technically possible.

Kind regards,
Dimitris