DDOS Packet Capture Files For Investigation

Our network have been ddosed very heavily for the last 15 days.

These attacks are relatively small 50 - 100 mbits at most but in very very high PPS rate.My firewall counts 10Billion packets in a single hour of an attack period.
We are dealing with these attacks with a combination of freebsd pf transparent bridge firewalls and mostly null routing.

I were able to capture some packets from different attacks from last week and today.

After deeply checking these attack capture files I can see that our attack comes from several thousands different spoofed Ip addresses but always the same mac address in their packet headers.So I thought if this attack is coming to us from a single machine rather than hundreds of different zombie servers.

I don't have a clue how to trace back this attack and find the real ip address behind. My upstream provider also don't have enough knowledge to help me.

So after todays attack I thought about sharing my capture files during attack and hope that someone here will help me. And show me a way to trace back these attacks.