One way to defend against this attack is to rewrite packets as they flow through the AP to the outside world, mapping the DNS id and port number, TCP sequence numbers, etc., to a different space, then doing the corresponding inverse mapping on packets on the way back. The eavesdropper only knows the internal representation of those identifiers and cannot relay the necessary information to the external collaborator. Any spoofed response from the external collaborator will be transformed to have an identifier that will result in the response getting dropped by the victim, making the attack ineffective.
The mapping can be done using either a hash function, or a state table, and is robust as long as the mapping is unpredictable. In the case of hashing, we need to use a keyed hash, with the key being the destination IP address, to prevent the attacker from using a third-party DNS server to map out the key space. The choice between state table and hash function is not always clear, as it involves space-time tradeoffs. If the hardware provides cheap hashing, then it may be preferred. In our Linksys OpenWRT implementation the use of a state table was more efficient as hashing introduced a high per-packet cost that turned the technique into a bottleneck.