There are lots of assumptions being stated and opinions being provided. One of the assumption is about black holing. Do you really think black holing wasn't in place??? It works great against when an attack is against an individual and the traffic is not more than 500mbs. Against a sustained attack less so.
Using freely available info from public presentations at networking meetups, let us step thru the process.
If black holing is used against a detected host being attacked (/32) both local and upstream, it takes 150 secs to detect, 150 secs to implement. After another 100 secs it is fully mitigated. Most attacks against a single host are 600 seconds. So it buys you 150 seconds to 300 seconds unless the attack is longer than 10 minutes and then the benefit is greater.
So all an attacker needs to do when using a large botnot of openresolvers is to script a new host every 300 seconds. If the script is walking a range then it pays to blackhole the subnet (/24). Then you score 3600 secs to 7200 secs in protection and the blackholing works!
But if the script uses a pool of /20s (4096 hosts and 16 subnets) and then randomizes the host being attacked, well then you have an attack of about 1.2 million seconds. To spice it up you start 8 scripts dealing with 512 hosts (/23) each, so that attack lasts about 45 minutes. Obviously the /20 cannot be blackholed and both the /24 and /32 blackholing doesn't work.
The above is a typical volumetric attack. Let us assume the port is 1 Gb/s and the attack is 2.5 Gb/s. Clearly no filters on the 1 Gb/s port will achieve any result. What is required is to introduce into the path of the attack a 10 Gb/s port that will filter the 2.5 Gb/s attack and then the 1 Gb/s port can function. That is what clouldfare's business model is all about and they basically scrub the traffic reducing it to an acceptable level for services to operate. If a business is connected on 100 mb/s then clearly they cannot just quickly buy a 10 Gb/s port with some hardware to mitigate a 2.5 Gb/s attack in a short time period. They hire, at great costs, scrubbers like cloudflare.
A scrubber is basically, a mult-tiered system that forces traffic through a path. A basic 3 tier system would consist or switches, then routers, then dpi engines. The switches use TCAMs to drop the volume based on volume triggers against certain protocols as well as fragmentation, flooding and sync. The routers drop traffic against blacklists such as tor nodes, known attackers or even countries. (BTW: The USA is the most attacking country)!. The dpi then identifies hacks that have a signature such as worms.
