It's hard to know until/unless they are fully transparent. It was almost certainly inside plant resource exhaustion, otherwise you wouldn't need an IoT botnet

It's hard to know until/unless they are fully transparent. It was almost certainly inside plant resource exhaustion, otherwise you wouldn't need an IoT botnet to cause it. Multisourcing gives you at least path diversity in this case. Hopefully application software performance as well. This is handled in the Verisign example by basic mechanical sympathy; when your machines can push 10gbps (probably 4x that in the years since the talk), it is economically silly not to simply eat the DDOS. Eating a DDOS is always the first mark of maturity. You can then improve with additional network intelligence. The most common way is with using sample based packet analysis. You match an attack signature and feed that into your gear at the peering points using BGP with blackhole destination. You are now filtering at ASIC speed, terabits per second on modern chassis switch or router.