Recently, my server has been DDoS, I’m using Network Miner to capture network, and using Wireshark to analyze PCAP,
I see many TCP streams as below, without SYN Flags, Does anyone know the reason for these?

*I open Network Miner throughout the day. For that reason, I think I can capture full flow

TCP Stream