Cliente satura la red

Español

Tengo un cliente conectado a un servidor PPPoE junto con los demás clientes. Aunque está limitado a 5 Mbps mediante Simple Queue, comienza a saturar la red enviando una gran cantidad de paquetes (hasta 20k pps) y llegando a consumir por sí solo hasta 100 Mbps de tráfico RX.

Naturalmente, esto provoca que el uso de CPU del MikroTik pase de su estado normal (aproximadamente 60%) a niveles muy altos (95%).

Algo extraño es que todo ese tráfico no se refleja en las Simple Queues; únicamente puede verse en la sección de Interfaces.

Ya hemos realizado varias pruebas, incluyendo cambio de router, cableado y switch, pero el problema persiste. También se aplicaron reglas de protección contra ataques DDoS en el firewall; aun así, el cliente continúa generando una gran cantidad de paquetes, aunque con menor frecuencia e intensidad que antes.


English

I have a client connected to a PPPoE server along with the rest of the customers. Even though the client is limited to 5 Mbps using Simple Queues, it starts saturating the network by sending a massive amount of packets (up to 20k pps) and consuming up to 100 Mbps of RX traffic by itself.

Naturally, this causes the MikroTik CPU usage to rise from its normal state (around 60%) to very high levels (95%).

What is strange is that all this traffic does not appear in the Simple Queues; it is only visible in the Interfaces section.

We have already performed several tests, including replacing the router, cabling, and switch, but the issue still persists. We also applied DDoS protection firewall rules; however, the client continues generating a large number of packets, although less frequently and with lower intensity than before.

What router are you using?
What is the client hardware?
Do you have any idea where this traffic is going?

  1. El router utilizado es un MikroTik hEX.

  2. El cliente está conectado mediante un LiteBeam M5 configurado en modo router, con buena calidad de señal, y utiliza además un módem HUAWEI HG531 V1.

  3. Realicé un Torch para identificar hacia dónde se dirigía el tráfico y obtuve las siguientes direcciones IP. Cabe destacar que las IP cambian con el tiempo y actualmente ya no son las mismas.

IP Destino TX Rate RX Rate
142.251.210.78 1200 bps 1320 bps
138.255.248.79 0 bps 0 bps
57.144.163.33 7.4 kbps 3.4 kbps
206.206.105.78 0 bps 53.5 Mbps
45.57.102.194 0 bps 0 bps
57.144.163.32 0 bps 0 bps
142.251.210.74 0 bps 0 bps
157.240.14.15 0 bps 0 bps
45.57.103.187 0 bps 0 bps
57.144.23.32 0 bps 480 bps
8.8.8.8 0 bps 512 bps

English

  1. The router being used is a MikroTik hEX.

  2. The client is connected through a LiteBeam M5 configured in router mode with good signal quality, and is also using a HUAWEI HG531 V1 modem.

  3. I performed a Torch analysis to identify where the traffic was going, and these were the destination IP addresses obtained. It is important to mention that the IP addresses change over time and are no longer the same at the moment.

Destination IP TX Rate RX Rate
142.251.210.78 1200 bps 1320 bps
138.255.248.79 0 bps 0 bps
57.144.163.33 7.4 kbps 3.4 kbps
206.206.105.78 0 bps 53.5 Mbps
45.57.102.194 0 bps 0 bps
57.144.163.32 0 bps 0 bps
142.251.210.74 0 bps 0 bps
157.240.14.15 0 bps 0 bps
45.57.103.187 0 bps 0 bps
57.144.23.32 0 bps 480 bps
8.8.8.8 0 bps 512 bps