content: This is where I get confused.  The origin of the DDoS is sending gigs of data requests (wouldn't that take up as much bandwidth out as it requests?). Then the server is getting request after request for a webpage (port 80 is browser related last I knew). How would a firewall or anything be able to differentiate between a valid request and a request from the attacker?