There are several types of Distributed Denial of Service attacks, mitigation techniques can be specific to each case:
A few computers send a large amount of traffic, clogging the network of the victim and keeping legitimate connections from reaching it. In this category we can see:
- UDP Attacks: Using the UDP protocol on random ports forces the server to check if there's an application listening on that port. You can mitigate this with strict firewall rules.
- ICMP Floods: The idea is to initiate an echo request and never complete the handshake, doing this frequently enough from different hosts will make the victim unable to respond to legitimate requests. Mitigation techniques include blocking fragmented ping requests.
Every device has a table that stores the state of each connection (if you run
netstat you can see this "table"), this type of attacks aim at using every entry in that table to the point where no new connections can be added. (See "slowloris" for an example of this attack). Mitigation often includes timing out unfinished requests to free up resources quickly.
There are of course services that help prevent and mitigate these types of attacks, CloudFlare even has this service free of charge but Im sure there are others.
In general the concept of defense in depth applies here, having several layers of security helps lower the risk associated with DDoS attacks, however keep in mind that we are talking in terms of mitigation, even Github was DDoS-ed and with their massive infrastructure and great expertise they saw their service affected
If you currently are under attack I would contact CloudFlare and ask them for what options can they offer to you, then start planning a prevention strategy as soon as possible. Right now it looks like you were caught off guard so best of luck
Here's a great resource from arbornetworks