what type of DDOS attack?
if it's a SYN attack, drop the IPs with
Code:
for i in ` netstat -tanpu | grep "SYN_RECV" | awk {'print $5'} | cut -f 1 -d ":" | sort | uniq -c | sort -n | awk {'if ($1 > 10) print $2'}` ; do echo $i; iptables -A INPUT -s $i -j DROP; done