What exactly causes 100% CPU load?

RouterOS Beginner Basics
1

My router is constantly being DDOS’ed (don’t ask me why :slight_smile: ).
I made some scripts and see that during ddos my CPU is loaded 60% which makes it inaccessible. But in particular CPU 3 is loaded 100% by some firewall operations (from the Profile tool).

How to know exactly what FW rules are being processed?
I would gladly disable those FW rules. Just need to understand what causes router to go down.

PS: ICMP is disabled as a TOP fw rule in my config. So it’s something else.
PS2: https://help.mikrotik.com/docs/pages/viewpage.action?pageId=28606504 this also has been applied. Didn’t help.

2

All FW rules have counters … check which counter is incrementing the most while under DDOS. Don’t blindly disable that rule, result might be vulnerable LAN.

3

check if the dns responder is active or not, eventually put a firewall rule.