[tptacek]

My understanding is that Cisco has EOL'd Guard.

Modern switches can also drop packets based on reasonably complex ACLs (which in practice is much of what DOS products did). The real cost of DDoS attacks is the focused engineering time required to design and implement mitigation for each and every one of them.