I'm reading up on DOS attacks, and just wondering, what is a syn attack exactly? What's the best way to distinguish between a DOS and syn attack in ssh?

Thanks,

You can find more information here
http://www.datums.net/DDoSAttack.pdf

Regarding SYN and other attacks.

Or http://www.winnetmag.com/Articles/Index.cfm?ArticleID=37488&DisplayTab=Article
and
http://www.securityfocus.com/infocus/1729

:)

BTW- You can check the current SYN tcp packets receiving using :

netstat -np | grep SYN_RECV

;)