On Multi-Point, In-Network Filtering of Distributed Denial-of-Service Traffic