Error: 10054

In the past week, 3 times I have had our webserver get this error virtually non-stop for several hours at a time.

I think it's due to what it says here http://msdn2.microsoft.com/en-us/library/ms189083.aspx

Connections May Be Forcibly Closed When Running on Windows Server 2003 SP1

When testing scalability with a large number of client connection attempts to an instance of the SQL Server Database Engine running on Windows Server 2003 Service Pack 1, Windows may drop connections if the requests arrive faster than SQL Server can service them. This is a security feature of Windows Server 2003 Service Pack 1, which implements a finite queue for incoming TCP connection requests. It results in the following error:

ProviderNum: 7, Error: 10054, ErrorMessage: "TCP Provider: An existing connection was forcibly closed by the remote host ...

To resolve this issue, use the regedit.exe utility to add the following registry key:

Key Type Name Value
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParameters DWORD
SynAttackProtect
00000000


Security Note:
Setting this registry key may expose the server to a SYN flood, denial-of-service attack. Add this registry value only if necessary and with an understanding of the security risks. Remove this registry value when testing is complete.



Twice I had this problem after restarting the database server. Could it be that the requests are somehow getting queued and then when the database server comes back up, it gets hit too hard? So then it goes into "protect my ass" mode?
How do you test where these connection requests are coming from?
I don't really want to disable this security setting...