Hello,

since about a week ago, router log reports once or twice a day login failures from user admin via winbox, but the IP that it shows is from one of its own interfaces. I'm all puzzled with this. any ideas?

log shows:

Mar/25/2016 12:16:37 memory system, error, critical login failure from user admin from 192.168.99.10 via winbox

192.168.99.10 is one of this router's interfaces, so, how could it attempt to login via winbox?

ip add clone?

Hello,

since about a week ago, router log reports once or twice a day login failures from user admin via winbox, but the IP that it shows is from one of its own interfaces. I'm all puzzled with this. any ideas?

log shows:

Mar/25/2016 12:16:37 memory system, error, critical login failure from user admin from 192.168.99.10 via winbox

192.168.99.10 is one of this router's interfaces, so, how could it attempt to login via winbox?

Same thing happened with my MT server. I finally discovered that it was The Dude server, trying to probe again and again. The password in the settings of the device, in my local map, was wrong. Check that out.

Does it mean you use admin account for Dude logins? Not so smart. Anyway using default admin account for whatever purpose is not smart at all.