ISPs have a very decentralized network, that is, they have routers in a lot of places. If you sum up the available traffic capacity, you get a number that's fa

ISPs have a very decentralized network, that is, they have routers in a lot of places. If you sum up the available traffic capacity, you get a number that's far bigger than 250 Gbit/s. But that's not the right comparison to make. Much of that DDoS traffic goes through multiple of the ISP's routers, and if you're doing just a numbers comparison, you'd have to multiply the attack rate by the (average) number of hops. But things are even more complicated in reality: many smaller links will have only 10Gbit/s or 20Gbit/s or 40Gbit/s capacity (or maybe even 1G), and saturating them not only causes increased latency, but also routing the traffic around causes more overall load on the network. Then there are management systems behind firewalls, and if you DDoS them, it's typically the firewalls that give out first. Finally, customers don't get the full throughput internally available to an ISP; if you DDoS a customer's IP, their link will be saturated, even if the ISP itself has plenty to spare. (Not a network engineer myself, but working closely with some).