hi every one, is there any reason that router os infected by some sort of virus?
ive config my mikrotik ccr1016 and its work fine until 5 month later! suddenly my internet provider call me that your network is uploading high amount of data! ive check my config (as you can see in jgp attached) i found nothing!! even in torch! as you can see in image below my uploading is about 2 Mbps but its uploading 3Mbps!!!
this suddenly happens at 11pm 7 days ago.
i use hotspot.
Capture.JPG
Check your firewall, make sure DNS and web-proxy aren’t being used from the Internet.
If the web-proxy is left unprotected it will be used to “anonymize” connections.
thanx for your replay
but my webproxy is set to be off
and this problem suddenly came from no where
- If you sum Torch data you will see that you have 2381 kbps TX … it is not 3Mbps but it is not just 2Mbps
- Maybe you have MTU mismatch and packets are retransmitted or heavily fragmented
- If you have open DNS then your router could be part of amplyfing DDOS attack when your DNS receives small “question” but sends big responses
- Have you firewall properly configured ? It is minimal sample
/ip firewall filter
add chain=input comment="Accept WinBox" dst-port=8291 in-interface=ETH1-WAN protocol=tcp
add chain=input comment="Accept icmp - ALL - could be removed" protocol=icmp
add chain=input comment="Accept connection state=established,related IN" connection-state=established,related
add chain=forward comment="Accept connection state=established,related FORWARD" connection-state=established,related
add action=drop chain=forward comment="Drop connection state=invalid FORWARD" connection-state=invalid
add action=drop chain=input comment="Drop ALL" in-interface=ETH1-WAN