Very fair questions. It depends. One scenario might be that all the PSN servers are behind one route in. This means that if you try to log in, or if you try to access something, you're going the same way through the network. If I then attack the PSN auth servers, I can fill up the links for all other services. Then you'd place a restriction on the amount of bandwidth for one service, or one address. That would mean the attack couldn't stop all other services you're running, but log in would still be down.
The problem is that you need to block traffic from those that are attacking. Reflective NTP attacks were all the rage half a year ago. You could get any server or router or anything that would help other devices sync what time it is (NTP-protocol) to spam whatever you wanted. Basically, you told a server "hey, this address wonders what time it is". Actually what you did was say "So, you can tell me what time it is, right? But, where do you get the time you know it is from? Can't you tell me the 300 servers you know of that you get the time from?" and pretend it was sent from, say, PSN. Then routers, servers and other things all over the world would start telling PSN "here are all the servers I know of:". You'd amplify what traffic you can create by sending one tiny packet to one server and have it send a lot, lot more back to what you were attacking. But the internet is basically closed down for that type of attack now. Or, it should be.
Botnets are what's being used now. You infect machines, or take over hardware, and you abuse it to do your bidding. People provide botnet attacks for money. That's why this is completely ridiculous. If you have a small amount of cash, you can likely shut down a small service for a few hours. You just place an order on a dodgy web page. You don't need to know what you're doing at all. The "organisations" that have these botnets just keep harvesting bots. Fending off these attacks is hard. An easy attack to fend off is to just look at all the packets that comes in and realize"oh, they all say "HELLO I AM AWESOME" (just as an illustrating example)", and stop all packets that say that. But it's likely randomized, and even disguised as "proper traffic". That makes it very hard to stop. You can then start looking for "OK, who's trying to log in five hundred thousand times per second?" and start blocking them. The more you think, the more the counterpart reacts. The internet will always have capacity to overload a service. That's why DDOS can always happen.
We scan for botnets on our network and we find them. They're easy enough to spot. I don' work with that, but I wish other organisations would do the same. There are so many things that are being used in botnets. Getting rid of that is really the only way to stop DDOSes. Or at least severely cripple them. That's when people have to use their own machines to attack. That's when they're easier to catch. Now it's nearly impossible to catch them, since it's never the attackers machine that does the attack.
This didn't really answer my question, and it seems you work in a more peripheral part of networking, not directly handling DDOSes yourself. No criticism meant.