Sounds like something VXLAN is well equipped to handle - VLANs tunneled over IP to create private networks in large cloud environments: http://en.wikipedia.org/wiki/Virtual_Extensible_LAN I wonder if DO will be using something like this to mitigate direct attacks (though VXLAN wouldn't solve the problems of link oversubscription—but there are other mechanisms in place to solve this)