It's trivial to counter indeed; you don't need any packet inspection for that. The main anomaly is not in the header structure, it's in the number of sessions opened simultaneously by one host. This particular tool uses broken headers for some reasons; other ones don't. But they all open sessions excessively.
So you just use iptables connlimit match block the clients with more than e.g. 10 connections.
So you just use iptables connlimit match block the clients with more than e.g. 10 connections.