This question already has an answer here:
- I am under DDoS. What can I do? 3 answers
Is using Free/Open BSD + pf a workable option for filtering DDoS? Which of the two would perform better under heavy load? (SYN flood maxing a 1 gbit pipe)
Is this even an option to consider, or is a full hardware DDoS filter needed to get fast enough performance?