My experience of DoS and DDoS attacks is based from being a Cisco engineer for an ISP and later as a Security Manager for a very large Global. Based on this experience, I have found that to effectively deal with large scale and complex attacks requires a good partnership between the organisation under attack and their ISP or DDoS mitigation partner (Yes there are now companies dedicated to this, in essence they are a very large ISP in their own right but use their global network to take on the additional traffic generated during an attack).
Below are some considerations if you face an attack that is outside of your bandwidth tolerance (aka bandwidth consumption) and you need help in responding.
Where no mitigation partner exists:
Establish a strong relationship with your ISP. Identify the right teams and contacts that you will need if there is an attack.
Use your firewall (or other logging device) to obtain evidence of the attack (source IP, protocol, packet length, etc) as this information can be hugely valuable to the ISP in deciding how to respond. It's not fun trying to trap traffic on a Cisco routing device from the command line at three in the morning! So any help is appreciated. :-)
With this your likely approach will be to filter out the traffic within the ISP cloud. If you have been able to provide enough information and the traffic is such then the ISP may well be able to filter out the malicious traffic and leave valid network traffic free to access your network. However if you are causing latency issues for the ISP then they are likely to black-hole your entire route at their BGP gateway and you will disappear from the net. Additional routing filters cause load on gateways, so don't expect your ISP to add multiple filters as this may well impact on their other users.
Using a mitigation partner:
I can only speak from the experience of one provider for this, so you will need to do your homework to decide if you require this and if so who would be best placed to provide.
The service was based upon BGP route advertisement and attack monitoring. Once an attack had been identified the mitigation partner advertises your route to pass through their network, where core routers are used to filter out the malicious traffic prior to passing on to the organisation.
My role in all of this was to test the implementation of a partnered approach to DDoS mitigation. This involved utilising a global team of security engineers to generate enough traffic to make for a valid test. We were testing both the ability to identify an attack and then to respond effectively. Based on this, we were very impressed with their overall approach and the solution worked.
