Nice post from the  Internet Storm Center that explains how to investigate and mitigate DDoS attacks.