Hi, we are at v6.43.4 on our CCR1036.
There is something weird going on since a week.
Many PPPoE users are automatically uploading at more than 100Mbps to one specific IP 185.71.66.40, while their plan speed in queue is less than 10Mbps.
Howcome the PPPOE is over riding the queue defined speed of those users ?
And the pattern is same for all, in every 3 minutes, sudden 100Mbps upload to 185.71.66.40 starts and stays full 100Mbps for 3 minutes and then again stop and again starts after 3 minutes.
Is it some kind of known attack into microtik ?
SO, is there any way we can block a specific IP in mcrotik firewall rules ?
I tried with chain forward drop with both src and dst 185.71.66.40, but its not block and still the customer PPPOE shows this super high usage only to this specific IP.
Whats wrong ?