SYN flood start implies the server is under SYN flood attack.

timestamp is the date and time the SYN flood attack started.

dipaddr is the bound IP address of the SYN flood target.

dport is the bound port of the SYN flood target.

proto is the IP protocol type.

correlator is the Intrusion Detection Services (IDS) trace correlator. You can use the correlator to find the corresponding EZZ8651I Syn Flood End message.

probeid is the unique identifier of the probe detection point. See z/OS Communications Server: IP and SNA Codes for a description of the Intrusion Detection Services probe IDs.

sensorhostname is the fully qualified host name of the IDS sensor.