the hosting company is the only one /able/ to respond, (well, depending on the attack type. the nastier attack types fill your pipe and/or overwhelm your route

the hosting company is the only one /able/ to respond, (well, depending on the attack type. the nastier attack types fill your pipe and/or overwhelm your router's pps capacity... your upstream is the only one who /can/ address that.) however, standard practice in the hosting industry is to disconnect the target, temporarily or permanently. the thing is, cleaning up this shit gets expensive fast. And there is plenty of 'splash damage' to your fellow customers. I was taken out a few months back by a DDos. Fourteen thousand dollars in SLA credits I paid out. The customer? was paying me one hundred fifty a month, and this was the second time he got hit with a major attack. I asked him to leave or help me pay for the damage. Obviously, he picked the former option. but yeah. my upstreams wanted me to get rid of the guy after the first attack. 'finishing the job' really is standard practice, if the attack is sufficiently large. Personally, I think this fact is one of the reasons why the problem isn't going away. Service providers, the only people who /can/ do anything about it, well, they can spend a whole lot of time and effort tracking down the source (being as most DDos traffic is spoofed, this is quite difficult) or alternately, we can just take the target offline. the economics of the situation are all wrong... but I don't know how to fix it.