DDoS mitigation: upstream filtering (ISP or scrubbing centers), anycast routing (distributes attack traffic), CDN (absorbs volumetric attacks), rate limiting, Cloudflare/AWS Shield.
Reactive mitigation: blackhole routing (drops all traffic — causes DoS but protects infrastructure). Proactive: traffic scrubbing centers clean traffic before delivery. Content delivery networks distribute load.