This is not a question asking how to stop an attack. This is simply a thread for anyone and everyone to discuss ideas for preventing, dealing with, and keeping your server alive during these attacks.
Do not discuss using 3rd party software, this is a place to make your own ideas and read others.
Post examples if you'd like. Post ideas how to filter out flood attacks. Post ideas how to keep your server alive while being under a heavy DDoS attack.
During a DDOS SYN attack, I moved my site to a 2nd IP and had my ISP block the original IP at their level. While this did create a bit of downtime as a result of DNS propagation, it did relieve the load and get me back online. Blocking the original IP at the ISP level kept the DDOS from reaching my servers. A secondary DDOS attack was then launched made up of legit connections, but lots of them. I ended up patching my Linux firewall's iptables to use ipset for better performance as I blocked the thousands of IPs.
After the attack I tested various firewalls (sorry, no Cisco). PF with it's synproxy flag from the BSD family gave the best results. Unlike most firewalls that just kicked in rate limiting during an attack, pf with it's synproxy stopped a lot of the connections at the firewall. Also, pf's tables have great look up performance and are dynamically updatable. No reload required. pf also has a lot of options for tuning performance and scrubbing incoming packets/connections.
netfilter with ipset gave good performance, but no synproxy.
Another possibility is to use cloud based hosting, allowing you to keep throwing more bandwidth and hardware at the attack so your clients don't feel the attack.
The only way to truly prevent a DDOS is to keep your server(s) off the internet. But then you have to explain to management why no one can see your company's website. :-)
There are a lot of different types of Denial of Service (DoS) attacks and no single solution can solve this problem. Web Application Firewalls (WAF) can be used to protect servers from the flood of traffic produced by a Distributed Denial (DDoS) of Service attack. Often these attacks contain a large volume of the same type of request. A WAF can rate limit or even block a specific user that sends a large number of http requests. A ICMP ping is another common DDoS type, if you block incoming ICMP with your packet filtering firewall then this will mitigate the attack.
But eventually with enough traffic the infrastrucutre around you will began to crumble and your server will go down. Routers for the backbone of the internet have become clogged by DDoS attacks produced by worms. Recently, UltraDNS was DDoS'ed which caused Amazon.com to go down: http://www.securityfocus.com/brief/1053
Finley, it doesn't take a massive number of packets to take down a server. A Denial of Service attack can be as small only 1 malformed packet. A buffer overflow can cause the server to crash, or even worse, give full access of your server to a hacker. Make sure your software is up to date.
There are companies which specialise in this sort of service. They have huge bandwidth available so that they can take a hit and only filter out legitimate requests to your servers.
Update: If you really want to try to do it yourself then first of all consider the fact that there were attacks with 50-80Gbit/sec sustained bandwidth. And each year it only gets bigger and bigger. I won't be surprised to see 100+ attacks this year.
Now regarding defence:
Before your application is under attack - try to think as an attacker - what are the weakest parts? Attacker will be hitting pages that require only a few bytes to be uploaded to your servers but that perform a lot of heavy lifting on the server side (e.g. any sorts of searches with wildcards etc). Pages accessible without authentication should be reviewed first. Try to come with a solution that will allow you to quickly turn this functionality off without switching the whole site off.
Some attacks originate from specific countries only (e.g. China, Russia, Korea(s) ). You can prepare ACLs for your routers that will block all netblocks that belong to a specific country. But be careful, under a massive attack chances are that your firewalls will be striggling with the CPU load.
Good luck!
mod_evasive is one of the best server side contra measures that you can take, if you are running an Apache web server - http://www.think-security.com/protect-your-apache-web-server-with-mod_evasive/