I’d like to be able to find IPs with excessive numbers of connections in order to find potential spammers/infected computers. Using the “torch” command works fine, but I want to use the API to extract/log this information.
Is there any way to display ALL active connections using the API and/or command line?
If I do a “/ip firewall connection-tracking print” command from the terminal or API I only ever see ~2050, even though winbox reports 5-10x that number. This number has been reported in several other posts, so I assume it is a hard coded display limit in router OS. I tried to use torch, but /tools/torch doesn’t seem to work with the API (it returns nothing).
I’m using the newest version of the PHP api.
Does anyone have any suggestions on how to achieve this?