B. Add to list for 24 hour (can be changed)
C. It should only tarpit until certain degree, then go to
D. drop to not kill the router by eating CPU by tarpitting to many IP.
Tarpit is only an option as mention in first post.
I have not had any problem with this rule on my routers.
\
Use Splunk> to log/monitor your MikroTik Router(s). See link below. 