It's like a large city in a way. Most of your roads are local, and so is most of your traffic. You try to distribute load and makes trips as short as possible.

It's like a large city in a way. Most of your roads are local, and so is most of your traffic. You try to distribute load and makes trips as short as possible. For a city its grocery stores in neighborhoods. For an ISP, they do this by peering locally with major providers. Google, Twitter, Facebook, Netflix, etc. all have very large networks and will openly connect at Meet Me points in open and private internet exchange sites as will CDN providers. https://en.wikipedia.org/wiki/Internet_exchange_point https://en.wikipedia.org/wiki/Internet_exchange_point. Some providers such as Google and Netflix will even install local caching servers that you can reach from your network if you have enough traffic. As a small ISP, you try to take advantage of all of that. Your option of last resort is the Tier 1 upstream provider. That's for anything where you can't get to it via local transit peering. This should be a smaller percentage of your traffic and it costs more than peering arrangements. The nature of a DDOS is going to fill that smallest and most expensive connection that provides the filler access to the majority of the world but doesn't handle the majority of the traffic. Even as a hosting provider, it doesn't have to be overselling. If you have 250 1Gbps customers and 250 Gbps of bandwidth, you'll still be useless in the face of 250 Gbps of junk traffic. Pick a random packet and tell me what should decide if it is dropped is something that has to be determined upstream of the saturated link. EDPnet looks pretty well-connected too: https://bgp.he.net/AS9031#_ix https://bgp.he.net/AS9031#_ix