https://kb.mazebolt.com/knowledgebase/rst-syn-flood/

C. Wireshark capture shows multiple SYN requests and RST responses from single/multiple IP address(es) In a SYN flood attack, the attacker sends a large number of SYN (synchronization) requests to a target server, often with spoofed IP addresses, in an attempt to overwhelm the server's resources and cause it to become unresponsive. When analyzing traffic using Wireshark, you might notice multiple SYN requests followed by RST (reset) responses. This is because the target server sends RST responses to the incoming SYN requests to indicate that it is not able to establish a full connection due to the flood of incoming SYN requests. This behavior is a characteristic sign of a SYN flood attack.