I have a CCR1036 that has a 100 megabit/s circuit behind it. When doing an iperf and filling the pipe (85Mbit/s queue), Winbox is transferring 6.3Mbit/s across that same WAN pipe. I find in troubleshooting, I have to carve out a larger than expected slot for Winbox to not crap out as my customers are using the pipe to it’s fullest.
Can anyone shed light on the reason why Winbox gets chattier when the pipe is full? When I open up multiple windows to graph, I could see it reaching to the device for data more often - but I tested with all windows closed except for the firewall rule page (which is - sad to say, not very populated; but it is a point to point.)
I only mention this because the service provider has a much harsher cap on that 100meg than I do - and it does throw Winbox for a fit. I just didn’t expect to see a relationship between circuit utilization and 8% increase just because I have Winbox attached to it.
I’ve labbed this up in eve-ng on 6.48.6 (production is on 6.49.7) and does NOT exist in the lab - I’ve run out of time to chase further, but the problem seems to persist - whether simple queues, no queues, or queue trees engaged. I have no idea why the router would be sending tons more data to winbox when just moving data within the router.
I have multiple routers that forward multi-gigabit/s and winbox traffic is negligible and not at all related to the forwarded traffic.
There’s something else going on. Maybe you have some window open that keeps refreshing tons of data (eg: firewall connections, etc) that causes increased winbox traffic.
Funny enough, I tested with all sub winbox windows closed out and the issue still happened. I obviously can’t look at remote queueing etc if I do this - however, if I do an iperf3 between the site and the data center, I see it cap out to ~85mb/s (giving me 10mb/s max, total of 95mb/s). If I shut down winbox, I see ~95 megabit/s consistently.
I’ve done a packet capture - and something is definitely sending winbox data - lots of 1300 byte full packets. I’ve ALSO stood up a loopback address (so that the session isn’t saved) and the problem follows.
And I agree - there should be no reason for winbox to receive this data just during file transfers. Perhaps I’ll sanitize my config and post… because it’s all I have left.
RESOLVED - so I have previously set up remote logging with a target syslog server. Incidentally, we have rules on the firewall that are set to log everything - and what is happening is the “MEMORY” option of the Mikrotik is sending a duplicate of the LOGs to winbox full time. (“info” logging was set to memory)
Turned off logging for the forwarding rules, and I have much less (<100kbit/s) traffic even during heavy use. Also - restructured “info” to be remote only, still no problems (syslog will be categorized as normal traffic and share the pipe, management unaffected.)