thos is a tip to know what is happening:
if you have a firewall check the logs files under /var/log, check if you're receiving packets directly ti a specific port and check the protocol, if you are under attack you will see packets comming using the protocol ICMP or UDP, and their destination will be the PORT 80, if this is the case call your IPS and have them blocking all the ICMP and UDP packets directly from there, that is a beginning but this could really put you on the map again.....