I doubt anything in this thread will help against a real large scale DDoS. Sure, it might help against a couple of skids, but not anything more.
Anyhow, for Linux you can use DDoS-Deflate, a small script you install which runs in a cronjob every minute. Basically what it does is check the output of a command, the command will show a list over IP's with their connection count, if the connection count is over the set threshold it will block the IP using iptables or apf and will send you an email with the IP's it blocked.
As said, this will only help against small/medium sized DoS attacks, not a real DDoS. If the attack is larger than your connection it does not matter what you do on the server, if your pipe is flooded there isn't much you can do except a nullroute or if the GSP can block the offending IP's in their border routers (/other routers which exists in their network).
http://deflate.medialayer.com/