Solid primer. Two distinctions that matter a lot once you move from reading about DDoS to actually defending against it. First, volumetric vs application-layer: a 2 Tbps amplification attack (memcached, CLDAP, NTP reflectors) and a 50k req/s HTTP flood against your login endpoint are both called "DDoS" but share almost nothing - the first is a bandwidth problem that only upstream scrubbing or anycast absorption can solve, the second is a compute problem that rate limiting, caching, and bot management at your own edge can address. Defenses that work for one are useless for the other. Second, why "just block the IPs" fails: the source addresses in amplification attacks are spoofed, and the reflectors are innocent third parties - blocking them means blocking real users' resolvers and servers. And the botnet-driven floods rotate through tens of thousands of residential IPs that look like your customers. The practical layering is: anycast/scrubbing for volume, rate limits and connection budgets for application floods, and - the one people skip - an upstream contact and a playbook ready before the attack, because negotiating with your transit provider mid-incident is the worst time to meet them.