Syn attacks ?

[ktk () BERLINGSKE-ONLINE DK (Klavs Klavsen)]

Does anybody know if it is normal, with these kind of syn-scans to my
firewall/gateway ?
btw. it is also masquarading - but answers to masquarading should only go to
ports 61000-65095 right ?

Mar 28 14:04:16 firewall kernel: Packet log: input DENY eth9 PROTO=6
212.237.190.66:1849 x.x.x.x::15420 L=48 S=0x00 I=4419 F=0x4000 T=118 SYN (#24)

Mar 28 14:04:19 firewall kernel: Packet log: input DENY eth9 PROTO=6
212.237.190.66:1849 x.x.x.x::15420 L=48 S=0x00 I=4420 F=0x4000 T=118 SYN (#24)

Mar 28 14:04:25 firewall kernel: Packet log: input DENY eth9 PROTO=6
212.237.190.66:1849 x.x.x.x::15420 L=48 S=0x00 I=4429 F=0x4000 T=118 SYN (#24)

Mar 28 14:10:34 firewall kernel: Packet log: input DENY eth9 PROTO=6
212.237.190.66:2045 x.x.x.x::6386 L=48 S=0x00 I=6255 F=0x4000 T=118 SYN (#24)

Mar 28 14:10:37 firewall kernel: Packet log: input DENY eth9 PROTO=6
212.237.190.66:2045 x.x.x.x::6386 L=48 S=0x00 I=6257 F=0x4000 T=118 SYN (#24)

Mar 28 14:10:43 firewall kernel: Packet log: input DENY eth9 PROTO=6
212.237.190.66:2045 x.x.x.x::6386 L=48 S=0x00 I=6258 F=0x4000 T=118 SYN (#24)

Mar 28 14:11:35 firewall kernel: Packet log: input DENY eth9 PROTO=6
212.237.190.66:2047 x.x.x.x::12792 L=48 S=0x00 I=6278 F=0x4000 T=118 SYN (#24)

Mar 28 14:11:38 firewall kernel: Packet log: input DENY eth9 PROTO=6
212.237.190.66:2047 x.x.x.x::12792 L=48 S=0x00 I=6280 F=0x4000 T=118 SYN (#24)

Mar 28 14:11:44 firewall kernel: Packet log: input DENY eth9 PROTO=6
212.237.190.66:2047 x.x.x.x:12792 L=48 S=0x00 I=6281 F=0x4000 T=118 SYN (#24)

I haven't snatched the packets.. but I guess I could set a program up to snatch
some packetinfo..
do any of you have any experience with this ? - as to how it is done.. as to
what to look for in a packet, to recognise what it is. etc. ?

I'd be greatful for any hints.

best regards,
Klavs Klavsen - IT-coordinator