Normal Traffic or Mikrotik Induced.

RouterOS Beginner Basics
1

Okay one thing about log prefix on rules is you see all the crap that normally is dropped that you were not aware of.

Case in point, I have been playing with my sandboxes (one PC, two HEXes).
What was annoying was.

  1. BOGON hits (not due to my source LAN - ) but due to destination of 224.0.0.252 (RFC 4795)
    apparently this is a link-local multicast name resolver.
  2. Consistent traffic dropped from my PC 192.168.Y.xx to 255.255.255 mostly on port 5678 (an unofficial mikrotik port?)
  3. Consistent traffic dropped from my PC 192.168.Y.xx to 192.168.Y.255 on port 5678

As far as I know I have anything associated with IP neighbours off!!

2

Do you see traffic targeting tcp port 5678 at any time or only when winbox is running on your PC? Could be winbox neighbour detection as those packets originate PC or so you claim…

3

Hard to say as I am using winbox log to view LOL…
I can peak at wireshark when and compare,
sandbox lan, cable internet - hex1
sandbox lan, cable internet -hex2
real homelan behind zyxel 40USW

And see if there is any appreciable difference from my PC.

4

You can also log dropped packets targeted at port 5678 (add log=yes to filter entry) … stop winbox for a few hours and later check log to see if timestamps are consistent with winbox usage or not.