This _was_ a bot army of routers. It just so happened that the army's orders were to do something uncoordinated and useless.

You can trust the users implicitly, or you can trust ASUS implicitly.

It seems that the appropriate place to deal with network traffic security issues is with the network bandwidth provider, which would be your ISP.

> It seems that the appropriate place to deal with network traffic security issues is with the network bandwidth provider, which would be your ISP.

This would imply that the ISP has abilities to interpose between malicious traffic and the user that, with modern technologies like DNS-over-HTTP, they simply don’t have. To most ISPs (that don’t force you to install MITM CA certs), user traffic is increasingly a black box. Which means that attacker traffic can blend right in as part of said black box. The only thing that can see into the black box is the device on the end of the line.

In most cases the device is getting it's IP information on boot by negotiation or request from the ISP. All the ISP needs is a database of blacklisted equipment and some middleware box to receive connections from insecure home devices when it detects them.

It's not about catching related traffic when it occurs, more managing the immediate implications from insecure devices on the network. The ISP can see the device, it doesn't need to inspect the traffic.