rogue traffic

RouterOS General
1

I have a rb750 at every one of my sites. I use it for ping tests, and speedtests for network performance. We do not have anything connected to its lan ports, only the gateway.

it sits on the same lan as other devices at this location.

somehow the gateway is showing about 20mbps constant traffic on the interface. I ran torch, it is showing traffic from devices that are on the same lan. Its not going through the RB as there is no up traffic. Its like its getting downloaded to the RB, but as you can see its not going to the lan ports.

I tried to reboot, upgrade software and fw, still the same.

Any idea what is happening here? I have this same setup at about 50 sites, this is the first time i am seeing it. Also, i confirmed the speed test is not running, and also you can see in the torch that traffic is going to devices that are on the WAN side of the device.

Any help would be much appreciated…

Thank you
Capture.JPG

2

So ive been watching it, and trying a few things, like enabling firewall, turning off service ports, making sure discovery is off on gateway.

nothing worked.

so i just kept watching it, then BAM, it all disappeared infront of my eyes. no longer showing the traffic on the lan via torch.

makes no sense, and traffic dropped to nothing…

any ideas?
Capture222.JPG

3

Bad firewall rules?

4

next time it happens try running the torch showing protocols and port. you could have been under some sort of attack or suffering from a faulty device on your network.