Even so, this one wasn't a particularly sophisticated attack. Even if we could weed out this particular type, many a DoS rely on amplification or asymmetrical computational cost with respect to the size of the request. So if we concluded that 1.4 MB/s of HTTP or DNS or plain TCP were a lot and managed to block these senders, it would be far from a universal solution against DDoS originating from domestic hosts. And there's reason to believe we'll see much larger botnets unless manufacturers of IoT devices start taking security seriously. So tomorrow 0.14 MB/s per home could be plenty.
What cost would this blocking incur? How often would I have to call my ISP because they blocked perfectly legitimate traffic? Unfortunately maybe not that often, because after the first few calls I'd probably figure that they are too big to give a shit about my problems.
In a recent attack there were 145607 devices sending >1.5Tbps[1]. That's a lot from individual connections.
(From: https://twitter.com/olesovhcom/status/779297257199964160 )