What kind of attack? Is this syn floods with dynamic IPs? It is very hard to track where an attack comes from because of bots controlled by attackers and they change IPs every 30 minute or an hour.

As suggested by monk it is better to use DDoS filtering service.

Good luck.