Correct, before I tweaked the screen settings, the attack would max out the session count. During the attack, the session count stays normal, so that part is working as expected.
My test is running a ping to 8.8.8.8 from a box inside the firewall. Once the attack hits, I usually see 2 packets with increased latency, then I loose connectivity all together. The CPU load, session count, and memory usage are normal with the screen settings I'm using.
I'll try to check the BW untilization on my WAN port. Thanks for the reply.