While similar to this question, I'm asking in regards to a traditional ISP environment where you are running your own server center and firewall access lists.
With a Bandwidth Exhaustion attack, the success of the attack is simply a measure of how much bandwidth they have purchased, in comparison to how much the target datacenter has available.
A well orchestrated attack will come from more than one ISP, or even many (DDoS), and the source IP address will be randomized. This makes it more difficult for the receiving ISP to block the traffic prior to reaching the customer's datacenter, and also eliminates simple retaliation as a possible (though undesirable) solution.
I'd like to know what the procedure is to minimize the success of such an attack, beyond the simple answer of purchasing more bandwidth? I assume identifying the source and blocking the packets can only be accomplished with the ISP, and there's nothing the datacenter owners can do on their end.
If the attack originates from other ISPs, is it necessary for the originating ISPs to cooperate to stop the attack?
When the DDoS attack is successfully blocked, is legal action often pursued? I assume the attacker could easily start a new account and run the attacks again otherwise.
This is a fiber-optic internet connection. At a certain level of bandwidth, do distant attacks become less successful? (assuming a limited number of attack sources)