DDoS protection for TCP services