Is the response to MONLIST also sent as UDP? If so, why does CloudFlare even accept those packets to IP addresses used for web hosting? Shouldn't all legitimate traffic be TCP on ports 80 and 443?
Also, web servers might want to consult NTP servers now and again.
CloudFlare doesn't host web servers for their customers. They forward HTTP/HTTPS requests to origin servers outside of their network (or serve from their cache). I don't think the DDoS traffic actually hit any of their customers' origin servers (assuming origin server IPs are not known by the attackers). But yeah, it still means CloudFlare's incoming pipes being hit with 400Gbps of traffic before they're able to filter anything.
[1] http://en.wikipedia.org/wiki/User_Datagram_Protocol#Packet_s...
[2] Not sure if this is even possible
The problem is you have UDP packets on port 123 coming from all over the world hammering at your door. They're politely getting dropped by firewalls, but they consume all the bandwidth in to the edge of your network, so the legitimate traffic cant get through.