Whats the best prevention for Ddos attacks?

Very good question.

For network your strategy should be : Using Firewall and IDS

For Linux/Unix based system and servers: You can use customized script.

Basically the principle is : limit the rate of packet so that your network can not be flooded.

I hope the following link(Cisco's white paper) will help you much:

http://www.cisco.com/c/en/us/products/collateral/security/traffic-anomaly-detector-xt-5600a/prod_white_paper0900aecd8011e927.html