Since ELB uses cookie-oriented stickiness, a crawler shouldn't ever get stuck to a single instance. However, since it's obviously a crap crawler you're dealing with here (since it's DoSing your site), it might be stupid enough to hold on to cookies it gets, in which case you're going to get hosed.
Personally, I'd recommend getting rid of the session affinity and fixing your app so it doesn't need it -- there are plenty of ways to do shared session storage.
Network load balancing is the distribution of traffic based on network variables, such as IP address and destination ports. It is layer 4 (TCP) and below and is not designed to take into consideration anything at the application layer such as content type, cookie data, custom headers, user location, or the application behavior. It is context-less, caring only about the network-layer information contained within the packets it is directing this way and that.
Application load balancing is the distribution of requests based on multiple variables, from the network layer to the application layer. It is context-aware and can direct requests based on any single variable as easily as it can a combination of variables. Applications are load balanced based on their peculiar behavior and not solely on server (operating system or virtualization layer) information.
The difference between the two is important because network load balancing cannot assure availability of the application. This is because it bases its decisions solely on network and TCP-layer variables and has no awareness of the application at all. Generally a network load balancer will determine “availability” based on the ability of a server to respond to ICMP ping, or to correctly complete the three-way TCP handshake. An application load balancer goes much deeper, and is capable of determining availability based on not only a successful HTTP GET of a particular page but also the verification that the content is as was expected based on the input parameters.
This is also important to note when considering the deployment of multiple applications on the same host sharing IP addresses (virtual hosts in old skool speak). A network load balancer will not differentiate between Application A and Application B when checking availability (indeed it cannot unless ports are different) but an application load balancer will differentiate between the two applications by examining the application layer data available to it. This difference means that a network load balancer may end up sending requests to an application that has crashed or is offline, but an application load balancer will never make that same mistake.
Reference:
Network Load Balancing versus Application Load Balancing
Best Answer
Both options are going to rely on HTTP cookies to make sure that each session continues to hit the same instance.
However, with option 2 (Load Balancer Generated Cookie), the EC2 load balancer will insert it's own cookie into the HTTP transaction with a specified expiration period. With Option 3 (Application Generated Cookie), you can have the load balancer check for cookies that you are already creating with your web app (like a PHP session ID) and the expiration period of the load balancer cookie will match that one.
With the 3rd option, you have some control over how the cookie expires allowing the session to move to a different instance, but with the 2nd option, your application doesn't need to be creating any cookies.
More information on this feature: