In this type of solution, an observer tracks an existing attack flow by examining incoming and outgoing ports on routers starting from the host under attack.
By nature of DoS, any such attack will be sufficiently long lived for tracking in such a fashion to be possible.