Even in the case of fairly large scale DDoS, if the attackers are not spoofing, you can filter them all, or create some sufficiently clever scripts to dynamically create rules without affecting most legit users
In the case of a DDoS that's a pretty big job you just gave yourself. Filter them all day if you like.... They are still coming through if the source is picking random IP's to send from. That would be an issue wouldn't it? "If" is a big word..... They don't do that any more unless they are stupid....

Then there RDDoS that spoofs too.... How do you mitigate that?

Not meant to be "offensive" Just want to make sure we all undersatnd the potential...