Check this, http://forum.mikrotik.com/t/ddos-story-or-warning-use-conection-limit-with-caution/49743/1