I'm a moderator of a major bulletin board. When a baddie shows up, we block their IP address; it works, at least until they find a new one. Why can't a protocol be developed for the world's routers to combat DDoS, whether by IP addresses or message content or something else, to stop DDoS in its tracks? There's clearly an answer, or else it would have already been done. Can someone give an executive summary of why it can't be done? E.g., it would require some central authority that doesn't exist.
Let's say that you run a shop. Every day, you might get a few hundred customers.

One day, you get tens of thousands of people coming in, who get in the check-out line, buys a trinket, and then gets right back in line to repeat.

Obviously, you are losing business from authentic customers who must wait hours in line.

Now, you hire a security guard at the entrance to verify that these customers satisfy some criteria.

However, there's still tens of thousands of people who want to get in. The only difference is that now, everyone must go through security. 

You notice that, from the authentic customer's perspective, you still wait hours in line, just that now it's just to get through security!
