The issue at hand, and what you have to minimize depending on what attack is being used, is malicious packets reaching your servers. Now, it is a fairly difficu

The issue at hand, and what you have to minimize depending on what attack is being used, is malicious packets reaching your servers. Now, it is a fairly difficult task to figure out what packets are malicious and which packets are real as they definitely look alike. Going with the latest web server attack (the long open connections with POST) there is not a whole lot of protection that could be afforded other than throwing more resources and more servers at the mix such that each of them can handle the open connections that are SLOWLY sending data to them. There could be time-outs, but those are easy to figure out with some experimentation and it doesn't require much to keep endless connections going forever and sending the bare minimum required to keep the connection alive. Other attacks like ICMP ping floods just flood the network to the point that the routers are unable to physically carry the traffic from point A to point B. They start dropping packets. If at this point you attempt a TCP/IP connection it most likely will not get through in the large flood. ICMP traffic can be dropped at the door, letting legitimate traffic through again, and generally can easily be taken care of at the edge routers. Then there are the various TCP/IP flood attacks which are mostly designed so that on the target a connection stays in an open queue whereby the host runs out of backlog so that it can't accept new connections, also known as half-open connections. SYN cookies help with this. Or still the best method is to have a VERY large botnet of computers that attack the target so that the amount of traffic is simply overwhelming no matter the method used. If your server is on a 100 Mbit connection, you can NEVER accept 1 Gbit worth of data. Now multiply that and start looking at where in the infrastructure there is a bottleneck. If inside your network you can accept 10 Gb's a second, but your gateway router is only rated at 1 Gb's a second you can just choke the router and it doesn't matter what is behind it. With massive DDoS attacks it becomes very costly, as you have to divert the traffic elsewhere first where it can efficiently be filtered for legitimate and non-legitimate and then have it be sent on to the actual backend servers that then respond.