[TECK]

Alfa1 is right, you can't do much if you got a DDos attack on your back. You have to wait and let it go basically.
DDOS is done in 2 phases, Intrusion and Distributed DoS. In the first phase the hackers try to compromise weak machines in different networks around the world. It is in the next phase that they install DDOS tools and starts attacking the victims machines/site.

All those companies who say they can actually stop a DDoS attacks... are lieing. If you are dealing with russians who have an army of zombies sitting on the net (Intrusion phase, they have over 10,000 servers to pound your site), you are really screwed... can't do nothing. Small timers, ya, they can be tracked and have their IP's blocked... that's pretty much what DDoS prevention companies do.

Want to see if you deal with a DDoS attack? Run this:

# netstat -lpn | grep :80 | awk '{print $5}' | sort

If more than 5 host/ip connects from the same network then its a clear sign of DDOS.
Block that network using iptables:

# iptables -A INPUT -s <Source IP> -j DROP

Use man iptables to find out more.

The secret to survive to a DDos attack is to use a good load balancer.
The only one I recommend is lighttpd. It will push the requests from specific IP's to a server who will probably crash on a regular bassis, leaving your important cluster nodes free of attacks.