With a REAL ddos attack you will get so many incoming traffic that your bandwidth is saturated before any software will come in effect. A real ddos is a hardware problem, and it cant therefore be solved by software.
> described as protection against a simple DDOS attack. With
> a REAL ddos attack [..]
I'm not entirely sure what is really classified as a "simple" vs "real" DDoS attack.
> With a REAL ddos attack you will get so many incoming
> traffic that your bandwidth is saturated before any
> software will come in effect.
I specifically said: "as long as the network bandwidth itself can hold out". If the network is saturated, it's saturated - it's game over, for anybody. But you'll find that most services will die way before this limit is reached. On a WordPress site for example you'll usually find the database will give out long before the bandwidth is saturated.
Even with legitimate users coming through some great filter like CloudFlare, it doesn't prevent a hug-of-death if you don't have some "smart" application level handling of high numbers of users. Like Linux OOM, when you hit your limits, the only choice left is to try and quickly and intelligently start killing without affecting the well behaved.
> ping, UDP, and TCP traffic.
Please bare in mind that the description is heavily simplified. If you're talking about bandwidth, of course this is the limit.
> It's really only effective against http traffic.
How so?
> Which means his upstream or provider is probably going to
> cut him loose for the duration of the attack.
There's nothing we can do about that, but being in the cloud offers at least some protection. DDoS'ing some random Pi at home is a little different from DDoS'ing an AWS server.
> A single person cannot effectively block a concerted DDOS.
Of course not, but that doesn't mean you have to make it easy.