A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer or network resource unavailable to its intended users. Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of the concerted efforts of a person, or multiple people to prevent an Internet site or service from functioning efficiently or at all, temporarily or indefinitely. Perpetrators of DoS attacks typically target sites or services hosted on high-profile web servers such as banks, credit card payment gateways, and even root nameservers. The term is generally used relating to computer networks, but is not limited to this field; for example, it is also used in reference to CPU resource management.
Ddos atack types: icmp flood/syn flood/teardrop/low rate ddos/p2p atacks.
There are a lot of reasons why ddos atacks cant be filtred:
1 there is no filter for something that is valid.
2 n+1 bit wont ever fit into an "n" bandswich
3 as long it exist ip spoofing no isp fil filter the source
4. hardware firewall like "established&related" will keep the connection alive for a short time,and after ALL valid connection will be cut.
What you can do to prevent ddos atacks?:
1 build an iptable to prevent atacks (this need be extremly well created)
2 talk with hoster for a fast reaction when atacks starts.
1gb/s connection to andedicated server is nothing compared to 30-40 gb/s atacks ..and NO1 can handle that ammount on active patch or the exploatation costs.
an hardware firewall got 2 impotant parameters PPS and Throughtput (besides the other algoritms) and thouse 2 are limited like all things on this world. An CleanPipes for an 1gb/s is arround 30k usd (maybe price dumped du time).
So thequestion is like:
What is untill the firewall true channel, how manny swiches, how manny routers,how manny human resources involved,whats the reaction time? what do you say?
In same time maybe you say i cut off all the external connection and check the log files for backtrack

. But do you think that some1 send ddos atack is stupid?
dont you think he use root+bounce+root+proxy ??? (and i mean l1/l2 proxy)
You cant do nothing when your log files are written with 30 lines/second

In same time an hardware firewall handle 12 mil threats but what you do when they are like 18 mil/30 mil, nothing can save you :P
Another solution is to keep server on linux..oh well ... to send ddos atacks to linux is hard..(linux to linux) but is not impossible . ask anonymus
In conclusion if you run an open server you need to handle with ddos. In same time you need to stop been an ashole cuz "always some1 better than you" and you can upset some1 who can take care of you. Be nice, dont offend users, be frendly and stop the show off.
ps: for Marcel maybe an apologyse will be enought for the atacks to stop... but that depends only on your human behavior.