but that would mean that you only redirect packets based on filtering out the botnet IPs, which would be pointless because if you could distinguish between botnet IPs and valid users, then you'd have the ddos problem solved