Firewall - Limit, DST Limit and Syn Flood Protect

RouterOS General
1

Hello,
I wanted to configure synflood protection on the firewall, however, for the sake of clarity, I would like to understand what exactly Limit and DST limit are in the Extra tab.
My current setup looks like this:

Filter rules:
add action=tarpit chain=input comment=SynFlooding connection-state=new in-interface=pppoe-out1 packet-mark=SynAsk protocol=tcp tcp-flags=syn

Mangle:
add action=mark-packet chain=prerouting comment=“Syn Mangle” connection-state=new in-interface=pppoe-out1 limit=400,5:packet new-packet-mark=SynAsk passthrough=no protocol=tcp tcp-flags=syn

raw - its just for informing me about
add action=add-src-to-address-list address-list=SynFloodPrerouting-List address-list-timeout=1h chain=prerouting comment= “SynFlood Info” in-interface= pppoe-out1 limit=400,5:packet protocol=tcp tcp-flags=syn


\

  1. Can I understand it as 400 packets per second? If yes why if I set it for 55555555/sec something still appears in my adress list from raw rule.
  2. What is burst - is there a chance to explain it on an example?
  3. What value should be set in order not to block the correct connections.
  4. In the case of 3way handshake, 1 syn is sent, and then depending on the traffic on the link. (am I right?)

Thanks for help!

2

@ref