I mean, by nature you can only react on stuff like DDOS attacks. As far as I understand, when the load from a certain network is spiking you try to drop packages or block the origin all together – depending on the situation. However, oftentimes bigger attacks swap their origin easily, which makes it hard to react.

Its simply not that easy to pursue a bigger plan.