hello, for several days there is no more traffic than usual but Ethernet is on too much processor consumption and on this there is lot of loss.
Do you have any idea where and what to look for ?
Any idea will be greatly appreciated.
What routerboard and what RouterOs?
RB2011 + 6.20 as you can see on the screenshot
I’ve seen this same issue on the RB2011s I run as well. It is not limited to the ethernet processes.
Its affected routing, bridging, and a couple others. One even happened with IPSec, and that router’s IPSec config has never been touched.
Only way I’ve found to fix it is to power cycle the router. A reboot/shutdown command never finishes. I’ve even tried to make a supout file while this is going on, but it never completes either.
One testament to Mikrotik is that the misbehaving router keeps passing traffic while the CPU is maxed out, but you have to pull the power to make any further config changes.
I’ve never seen it happen randomly when no one is in winbox, it’s always when I’m working on a config. But it can affect other process groups than the one I’m working on.
Is a RB2011UAS, and is doing only routing and static dhcp server. No IPSEC, Firewall or anything else.
Doesn’t help the reboot… even after reboot the processor is the same. Is happening lately one a day for several hours then is stable. And no matter is someone on it or no.. is happening - i see on big loss.
Very irritating situation because i don’t understand the reason and i know that after a while will disappear by himself with no intervention.
As you see… is working with no loss now and is almost the same traffic.
Any idea will be greatly appreciated.
Maybe it is just false number. Is also temperature rising? There is one ultimate general solution for all similar problems: netinstall and firmware upgrade after. May happen it will not help.
I don’t see a problem with your device. The numbers match up.
Don’t just look at the Mbps, look at the packets per second also.
You are getting in Excess of 170k packets per second in your first graphic.
RB2011 is rated for 227k packets with fastpath routing (NO firewall/connection-tracking whatsover), and 60k packets with 25 ip filter rules.
http://routerboard.com/RB2011UiAS-2HnD-IN
Your configuration is probably somewhere between those two examples, and hits the CPU limit at 170k packets.
So - this device is performing exactly according to specifications. It is your job to figure out why sometimes you have 170k packets incoming, and sometimes only 50k packets. I assume a compromised machine in your network, or incoming DDoS attacks.
Have you running scripts?
I’ll wait for the 1st time when occur to check the source of that amount of packets;
PS: There are 150kpps but RB2011 should keep 227kpps (as i said, i have no queues and no fw rules, no nothing - not even snmp or whatever)