Would this stop DDoS? (Score 2, Interesting)

For some time I've pondered the ways to stop DDoS.

Couldn't you write a program that scans each incoming packet and keeps statistics. Won't DDoS packets come far more frequently from a given source?

Is there a way to avoid spoofed packets by making sure you can reply to the source first? Shouldn't current protocols be designed to avoid spoofing? Or is it more fundamental (e.g. spoofing must be solved at a lower layer in the networking model)?

Where are the machines these attacks originate from located? Can't we get their ISPs to get rid of them, or ban ISPs that are known to be bad?