I work for CloudFlare so maybe I can shed some light on how we do things.
Fundamentally, CloudFlare uses an Anycast network design; this means that network traffic has no control to where it is routed and it is automatically routed to the closest available host. Computers compromised by botnets are typically distributed throughout the world in different geographical regions. Because of using an Anycast network we increase the surface area of our network such that it is harder for a distributed attack to take us down. The traffic cannot merely overwhelm a single datacenter, in order to grow out this protection we now have 86 data centers around the world and we plan to add more.
We also operate an open peering policy where we are willing to directly interconnect with ISPs (PeeringDB). By removing the middle-men we are able to have the shortest path from the source of the attack to where we can filter the attack. Today, we have the single highest participation in Internet Exchanges globally, of any network. By having a direct path form attacker to destination we can prevent collateral congestion on our network.
Yes, we need a large network to come with attacks, we need big pipes so people can't congest them - to that end our network is 96% bigger than the largest DDoS attack ever recorded.
This is despite the fact we have seen a whopping increase in attacks. There are some interesting characteristics about these attacks; they predominantly happen on weekends (attackers busy with something else on the weekday?), they happen against largely benign websites indicating that anyone can become the target of an attack and also these attacks are massive in capacity.
Almost all of our Layer 3 attack handling is now autonomous, we use a range of strategies to protect against attacks. When attacks come to our Edge we have worked out strategies in order to ensure we are able to reduce the impact of such malicious traffic; we then seek only to pass on safe traffic to the origin.
In many ways CloudFlare has become the DDOS filtering method of last resort; for Business and Enterprise we have advanced protections against DDOS attacks backed by a full SLA, we offer this at a flat rate to ensure that DDOS attacks aren't successful in bankrupting their victims. For at risk public interest sites we have Project Galileo offering this technology for free to those public interest websites who need it.
Currently one of the largest risks to the internet lies in open DNS resolvers, which can be used for DNS amplification attacks by hijacking insecure DNS resolvers; I would highly recommend looking at the Open Resolver Project to learn more. Finally, an article from about 3 years ago on our blog goes into detail about how the DDOS attack against Spamhaus almost broke the internet.