How to identify the initiator of a spoofed DDoS attack?

Question

DDoS Protection

Tell me, please, is it possible to somehow calculate the real initiator of a DDoS attack if it replaces the sender's ip (for example, Spoofed SYN Flood)?
Maybe by meta-information from packet headers?
That is, can we say that these two packets passed through the same network or router, which means that with a high probability they were initiated by one botnet?
There are articles about Packet Marking, but it's not very clear how it works.
It turns out that each router must leave its own label in the packet, but how should providers implement this?
Thank you!

Answer 1

If an attacker uses a botnet to attack, then this is almost impossible. Using SSYNF, an attacker replaces his IP in the same way as a heaped VPN would do. As for me and my experience with networks, I believe that this is possible, but very difficult.