>No matter how well you virtualize and manage your provisions, if one user has caused your incoming 10G to be saturated on layer 2, there's not much you can do

>No matter how well you virtualize and manage your provisions, if one user has caused your incoming 10G to be saturated on layer 2, there's not much you can do at layer 3 to QoS that. well, you can blackhole the target. Essentially, you tell your upstream to drop all traffic to one of your /32s (the one being targeted) at it's upstream. It finishes the job for the attacker, which is sad, but so long as you are willing to lose the customer in question, it solves the problem for you. For details of how to set this up if you are a he.net bandwidth customer, see: http://www.he.net/adm/blackhole.html http://www.he.net/adm/blackhole.html nearly all other bandwidth providers provide similar facilities; there are a few other things you can do to make this sort of thing more robust. But the point is that there are things you can do about incoming DDoS attacks... if you are willing to kill all traffic to the target IP address. I mean, for most ISPs this isn't automated... in my case, my pager goes off; I log into my quagga box, and I start typing. So you still see downtime, and yeah, you want to avoid it. But there are things that can be done.