If it's a syn flood there are very easy ways to stop them but..
Have you tried making a small program to track & log all signed in IP's then weed out the slaves?? If the server is getting anything from someone not logged into the game then maybe you found the some of the slaves?
After all no one here has downloaded any kinda programs to be considered a slave. So we need to find which networks are launching these attacks.
Code:
bash# netstat -lpn|grep :80|awk '{print $5}'|sort
Code:
iptables -A INPUT -s <Source IP> -j DROP
is your friend...
You need help writing some quick code to do this for you PM me.