This seems to filter everything (--tcp-flags SYN) ... 
header is probably not its place...
 -A INPUT -m state --state INVALID -j DROP 
could be enough

(the default logic of the builtin iptables has a footer like where packets are logged immediately before the general drop.)