On: Say Cheese: a snapshot of the massive DDoS attacks...

[zzzcpan]

BGP flowspec works kind of like that. Also routers don't have unlimited capacity to hold everyone's filtering rules, don't forget that.

[DenisM → zzzcpan]

Your typical large-scale attack has a few thousand IPs at most, so it's technically doable. All that's missing is the motivation for everyone to abide. With enough incentive hardware makers might accommodate, too.