This is what I used to believe as well. But I'm reading more and more about how ISPs are filtering out such attacks and how some dedicated networking gear (eg Pravail APS) can stop at least some types of DDoS attacks from saturating your web farm.

It's that side of things that I'm mostly unclear about. Are solutions like Pravail APS basically snake oil?