All true and we tried most of the things. It's getting trickier when the attack is from web-servers botnet with diverse range of IPs. They hit us with up to 15,000 pps now, so no software firewall or webserver can handle that. A really strong load-balancer and proxy help, with constant monitoring.