You could always try to improve the performance of your server and database configuration to handle 50-100 requests per second, and render the attack useless.

You could always try to improve the performance of your server and database configuration to handle 50-100 requests per second, and render the attack useless. A. Check the number of connections per IP. If any have an unusually high number, block them. B. Why is your site down? Database can't keep up? If so, why not, is it something simple like indexes not setup correctly? C. Did you actually check the load on your server? Double check it's actually being overloaded, and you don't have a configuration issue with server connections set too low, while your hardware is practically idling. D. How many pages are being accessed by the attack? Would you be able to cache them? E. Check server logs, and see if you can identify anything that separates these requests from your typical traffic.