un-idntified traffic and CPU at 100% RB450G

ven16 · September 30, 2013, 4:20am

hi,

i have a problem with my router board
it is using 100% and showing un-Idntified traffic on interfaces
below Fig: do not has LAN traffic but it showing 7.5 Mbps on WAN side

can somone please help me.

thank you,

ven

deejayq · September 30, 2013, 5:34am

torch on wan interface or go to ip firewall connections
what do you see?

rufee · September 30, 2013, 10:01am

Disable “allow remote requests” in DNS settings, had the same issue with my 2011 after i ran cpu profile i found out that DNS was using the whole cpu.

CelticComms · September 30, 2013, 11:22am

Using Torch on the interface will give more information about the traffic and what the source is.

ven16 · September 30, 2013, 2:42pm

Hi,

here is my torch on WAN interface and one IP Address using all bandwidth 146.185.142.174
can some please help me here

thank you

ven

mjperry82 · September 30, 2013, 4:20pm

It would help if you could run torch again with protocol and port checked so that we can see what kind of traffic it is.

ven16 · September 30, 2013, 5:18pm

Hi,
now I can not see that IP which I mentioned in previous slide.
but I can see some other IP addresses.
I am attaching screen shots below

thank you,
ven

XTX · September 30, 2013, 5:40pm

Hi

Try what “rufee” suggested…

mjperry82 · September 30, 2013, 7:02pm

And you probably want to add some firewall filter rules to protect your WAN interface.

wpeople · October 1, 2013, 7:27pm

i also see such issue on customer routers. My solutions was:

create an access list for used DNS servers
create a firewall rule to drop all incoming packets what’s targetting udp/53 and NOT originated from src-address-list=dns-servers and coming from WAN interface.

however i would welcome a solution from Mikrotik what allows to configure local DNS service access like other IP services:
offer a list of allowed hosts/subnets.