
The DDoS Was Coming From Inside the ISP Network
When multiple ISPs called us the same week about unexplained upstream congestion, we expected a peering issue. Instead, NetSense Flow revealed thousands of compromised subscriber devices launching coordinated outbound UDP floods toward Chinese ASNs. This is the story of how we diagnosed it — and why most ISP playbooks fail when the DDoS is coming from inside the network.










