maybe a dos attack ?

RouterOS General
1

hey
i have a mt2800 router recently some kind of attack happens in my router every night my traffic goes up to 800 megabyte
(my up link limited to 200 MB ) and cpu load goes to 100% ( only one core ) anyone have any idea ? it would be great to share your opinion with me .
thanks for reading

2

in this moment run torch tool to check who, when and where is attacking your router.

3

thanks but when this happens i lose my access to the router

4

Do you have webproxy enabled? How is the kind of traffic you are looking at, is it 800Mbps on the WAN port and almost nothing on the LAN, or is the traffic passing through?

5

thanks toni for replay
it was so weird i think it was a bug , after i reboot the router the problem disappear

6

What version?

7

in 5.21 version

8

Try to update OS version and firmware.

9

configure firewall for the router (input chain). make sure only you have access to the router itself

10

You should probably upload output from /ip firewall. The effect may be DOS but the intent may be something else entirely.

11

i found the ip that is attacking and block it after a while another ip attack form same range i block the range then attack begin in different source
is this even possible ? attack coming from one of our users not from internet
is there a rule for this kind of attack

12

If it is infected with some virus or trojan, yes it can happen. Try to add a rule on the firewall which will drop connections from suspicion addresses. Have a look at this http://wiki.mikrotik.com/wiki/DoS_attack_protection