Not even more servers - fatter pipe. We are using less than 1% of the inbound capacity of our connection in normal operation, yet the attackers easily filled i

Not even more servers - fatter pipe. We are using less than 1% of the inbound capacity of our connection in normal operation, yet the attackers easily filled it. The firewalls that we are running were easily able to absorb the additional traffic. Neil's metaphor of the post office was quite accurate - even in the heaviest attack, when we didn't have upstream DDoS protection turned on, about 10% of user traffic was getting through just fine - it's just that a random 10% of traffic makes for a very poor TCP experience.