Comment by musicale

> "These sudden UDP bursts had minimal source spoofing and used random source ports, which helped simplify traceback and facilitated provider enforcement."

That seems fairly blockable.