I apologize if the title I provide is irrelevant to the problems I have, because I am not proficient in English. I recently questioned why Rx from the outbound interface differs from Tx in the incoming interface. am I wrong with placement rules on mikrotik firewall? and the resulting bandwidth is higher than I’ve specified, on average almost 1 Mbps above the bandwidth I’ve set up.
You don’t control what someone from internet sends to your router. So e.g. some password guessing botnet could be sending traffic to your IP address, but obviously it won’t continue to LAN. Use Tools->Torch on LAN and WAN interfaces and see what exactly makes the difference.
I’ve tried using torch tools, but no suspicious activity I see