this is the second day i run a a new paid hotspot on mikrotik ccr1009 with 6.42.1 at a new customer so i keep a close eye to check it is working flawless.
one strange thing i notice today is someone is downloading using a paid voucher from user manager “R” but i cannot see his ip in dhcp leases.
as you can see in photo the ip is 10.5.50.39 and it exists in arp and hotspot active users but not in leases.
why i noticed that? because he was eating all my fiber line (max speed 30mbps), so i limit him to 10mbps.
another thing i notice in log is that he tried to log in to my router? port 80 in ip services is enabled for user manager. but maybe this is an accident because he wanted to login to hotspot with his voucher..
15:00:41 system,error,critical login failure for user a4bfwa from 10.5.50.39 via web
in torch i see only 3-4 connections to some ip’s x.x.x.x:443. is he using some vpn software or protection?
