AW: AW: [suse-security] compromised?

Of course only the SYN flag was set. ALL connection attempts start with a SYN packet and you will never see anything more in firewall logs if you are infact blocking the connection from taking place. The only time you will see more than a SYN packet

This is exactly what I said. The logs don't indicate the use of any service (gnutella etc.) but a trojan port scan.