s

[Enderman]

This might not always work as someone who actually knows what they're doing wouldn't perform a DOS using ICMP requests, they're usually masked under protocols that look like legitimate requests, and blocking this specific incoming protocol could mean that you're blocking legitimate users / customers (if you're a business) out too. Kind of a shitty situation

it just blocks pings

which is pretty much the easiest way to DOS

 

and OP is probably dealing with 12 year old children who dont know anything else

[Cree340]

This is for enterprise use but if you need DDOS mitigation you'll need a offsite solution such as Black Lotus https://www.blacklotus.net/protect/protection-for-networks/. Examples of onsite systems (albeit with less capacity) is FortiDDOS http://www.fortinet.com/products/fortiddos/ddos-mitigation-appliances.html or https://www.checkpoint.com/products/ddos-protector/. Even though such systems exist, most enterprise and large business grade internet connections have anti-ddos provided by the ISP.

For normal people, as said earlier, changing IP addresses and a decent firewall on your network should be enough but instead of just blocking pings, you should set its that it is in a  "stealth" and drops the ddos packets silently instead.