I use this script for similar purpose - http://www.inetbase.com/scripts/ddos/install.ddos

The advantage of this script is that it directly monitors the IPs using netstat so one could stop bots from hammering things other than your webserver, say socket connections.

It is customizable to use APF or iptables and worked quite well when one of my friend's site was hit.