SID: 99992 TCP SYN FLOOD Notification

We're getting this notification on a Mac Mini that we're using as a server.  We've setup the Intrusion Prevention policy to allow this traffic on this server, but to log the traffic.  We are still getting a notification on the server of this SID.  Any ideas what is triggering this?  This Mac is running RU4.