This isn't a new problem for us VOIP'ers. Bad actors have been breaking TCP for a while. We solved by putting a great big server/router up at a datacenter with

This isn't a new problem for us VOIP'ers. Bad actors have been breaking TCP for a while. We solved by putting a great big server/router up at a datacenter with a fat link. Any connection that misbehaves by ignoring TCP drops or flooding with UDP for more than a few seconds gets rerouted through that server. (New connections are made through this route.) It has outbound rate limiting down the pipe to the local networks. Keeps the local networks happy and fast. Isn't as expensive as routing everything through a datacenter because only misbehaving IP's get rerouted. Had the added side benefit that I could "protect" offices from the "involuntary" win10 upgrade.