How to deal with SYN FLOOD and extortion
lsc: your provider (or your network guy, possibly you)  needs to blackhole the source of these attacks (preferably notifying the ISPs in question.)  most of the better co-location providers will give you a way to blackhole traffic from certain IPs.  Really, you should be able to do that from your OpenBSD firewalls without help from anyone else, assuming the problem is too many syn packets rather than too much traffic.  dropping all packets from a particular source  IP is not expensive, even when you multiply that by a large number of source IPs.<please ignore this comment, I'm completely wrong.  see the next comment.>