Sniffing the trafic with sniffer on my CCR1009-8G-1S-1S+ I can see some weird IPs :
129.0.0.10
129.0.0.20
129.0.0.30
129.0.0.40
Why Weird ? Because of the end numbers (too perfects to be real IPs) and because of the fact that the device (CCR1009-8G-1S-1S+) is behind a strict gateway which does not allows incoming trafic from these.
This trafic only appears if the filter-interface is empty. Snffing the trafic on every single interface (ether1,ether2,sfp1) does not show any 129.0.0.x.
Analyzing the capture file in Wireshark highlight bad layer2 frames :
I’m seeing this too. And it’s hard to figure out where the traffic is coming from because the routeros sniffer either doesn’t work right or it’s lying to me because it shows the traffic on bond1 when interface is any:
1 0.035 bond1 129.0.0.71:49320 172.28.0.15:1891 tcp 188 1 no But if I sniff on bond1 it doesn’t show up.
I suspect that someone has two concurrent connections to Internet: one with your LAN and the second with eg. LTE and parts of LTE traffic is “leaking” to LAN interface.
The bytes counters are incredible - 4GB - and I run the sniffer only for approx 5 seconds each time (I am using PtP to connect to VLAN, around 40Mbit/s)
When I change VLANID, Src Addresses 129.0.x.x changes in captured connections, as long as existing connect exist prior to switching to none existing vlanXXX – ?
I was debugging my configuration with the tool “Packet Sniffer” from 2 routers “RB2011UiAS-2HnD-IN” with the OS 6.37.1 and I found myself seeing similar traffic. In my case the source IP is always 129.0.0.3. The weired part:
The direction is always TX.
I can’t see the traffic on the destination addresses (sniffing with tcpdump on the destination host).
I can’t see it entering the routers.
In one router the traffic is always TCP on the other is always UDP.
It happens on interfaces that are used as TRUNKs but the packet is on the parent interface and not in any of the VLANs.
I included the raw data of one of the packages. I see similar raw data on a valid traffic between a PC and a IP camera.
I hope this help to solve this problem.
I’m getting the 129 addresses in captures too. It looks like the packets are being damaged or the record of the packet is damaged. I have 172.16.. devices talking, and wireshark will show the source address as 129.0.0.*.
I’m exactly in the same case.
I’ve weird 129.0.0.vlanid packet broadcasting inside the vlan. Sometimes when users need more network ressources, the flow can gros as the consumed bandwith. Sometimes i had above 10Mbits/s or 20Mbits of weird traffic.
It doesn’t get caught by firewall and not visible in wireshark.
It’s not internet flow cause we disabled internet interface while rebooting router and switch.
On the top of network I’ve 2 DSL link with mangle in LB mode (ECMP) on a RB2011
1 trunk port with 5 VLans in RB 2011 going to a CRS with access ports & trunk port corresponding to these vlans.
All 129.0.0.X IP talk to clients in all vlan and network device on the same port.
I believe it’s some broadcast by mikrotik device in routing or hidden things.
When traffic up a bit more, “broadcast” is done in access ports with equal TX bandwith.
Not my decision unfortunately.
