We don't know anything about the attack, but in general: 1. All of this requires that you have more bandwidth than the attacker. 2. ACL drop everything but th

We don't know anything about the attack, but in general: 1. All of this requires that you have more bandwidth than the attacker. 2. ACL drop everything but the ports/protocols you use on your frontend IP. For github.com that would be TCP 80 and 443. (ACLs are cheap, can be done at wire-rate on any capable edge router, so they're a good "first step." In this case it would have the bonus of dropping DNS amplification attacks which are increasingly common.) 3. If it's a TCP SYN flood (probably from spoofed IPs) enable SYN cookies. (Of course now the bottleneck is their load balancer.) 4. If it's an L7 attack, they'll need to identify patterns in the requests to identify and drop the traffic. For example, the attacker may be requesting a single URL only. If it's an L7 attack on a TCP service, they can also automatically add a drop rule for that source address, because at this point the client IP will have been validated (via the SYN challenge). They may also be able to identify certain patterns in the traffic that can be ACL'd at the edge. For example, IP TTL being identical.