The problem with this type of attack is that you can't really catch it as MITM DDoS protection. You're not seeing any SYN flood, just a bunch of TCP connection

The problem with this type of attack is that you can't really catch it as MITM DDoS protection. You're not seeing any SYN flood, just a bunch of TCP connections (equivalent of say search crawler), that are encrypted. Only after unpacking on loadbalancer those are visible as one TCP stream sheltering thousand HTTP2 streams.