Analyze .pcap file for a ddos attack

I have come under attack from ddos a bunch of times and I have ddos protection through my host. They told me to take tcpdump captures while its happening which I have done and they said they made changes but its still not working. They now tell me that the dumps I sent them are not attacks but normal traffic. I use the server for openvpn only and when I compare the dump of just normal vpn usage and the attack it is completely different. Looking at the capture I think is an attack in wireshark there are over 6000 ips in a 10k packet capture which amounted to about half a second. I whois some of the ips and they are from ecuador bulgaria etc etc. I am not an expert and I just need someone to tell me what to say to my host so I can feel confident I am correct. I might be totally wrong and I don't really understand this stuff well so I need an expert. It should not take to long. Thanks!