Any IP address sending, on TCP port 53, packets with the SYN flag, but without RST or ACK is added to the dnssyn list.
For any IP address in the dnssyn list that sends, on TCP port 53:
Ten packets with the SYN flag, but without RST or ACK in one second during the TTL of the previous packet sent, drop the packet.
Five packets with the SYN flag, but without RST or ACK in one second during the TTL of the previous packet sent, reject the packet. Send an ICMP port unreachable message.
