Incase of huge DoS attacks they do something similar. But with DDoS attacks the spoofed packets are coming from so many different locations that it is hard to identify them, and often it is just stuff like compromised toasters.