Cisco PIX firewalls can automatically detect DOS attacks and deny them. But in the case of a router you need to have the ACLs in place to be safe