I love nginx. But most of these are mitigation for DoS only targeting the web server, not DDoS. They&#x27;re explaining how to throttle a single IP. The whole point of DDoS is to distribute the attack to bypass mechanisms that throttle single IP&#x27;s (plus to amplify).<p>Also the DDoS attacks that we&#x27;ve been hit with actually target our uplinks by saturating them with traffic, not our services. We have a 1 Gbps port and the last DDoS we were hit with was over 20 Gbps, which is a relatively small one. The mitigation we used was to have our hosting facility get their upstream provider to route the traffic through a layer 7 DDoS mitigation filter provided by an external company. It worked wonderfully.<p>These are cool features, but when your link is saturated it doesn&#x27;t matter what a daemon listening on a port does.