This flooding attack is slightly different from the one mentioned in the threats document because there is no real victim invovled. Just the routers and links which still needs to be prevented.
perhaps it would make sense to mention explicitly in the threats document that the target of a flooding attack may not be a host but an access link or an access router?
Erik