hi guys
I m having a trouble,When i used to connect router remotely via winbox and monitoered bandwidth ussage it show min 512kbps to 1 Mbps.I also monitored with torch and find there is no other connectivity only winbox ussage that much bandwidth.
wow... 
i think is not problem, because you are rich bandwith...
normally i never use winbox with remote...., here the BW is xpensive..
regards
Hasbullah.com
daer i m managing it remotelty via 100mbps LAN network not over WAN. 
As far as I know, winbox uses lots of resources (CPU) not bandwidth
what windows are open in winbox when you have this problem? maybe try closing some of them (or all just for test).
I had the same problem,
someone is relaying spam through you
mikrotik doesn’t have spam alert so you must
be very careful, add rules and all that.
change all default ports (specially web-proxy)
other than that it might be connection tracking
and you might have huge number of sessions there.
hope it helps.
what does spam relaying have to do with traffic from router to winbox app?
It happened to me that Mikrotik did not detect a session. I don’t know whether it is bug or security hole, but mikrotik simply did not detect spammer session, spammer was sending spam to my router and then to another PC in my network which had vulnerability and sending it out again.
it has nothing to do with winbox, but it was using a lot of bandwidth. I could only find out when the network speed was slow.
When i used winbox to log into a pppoe server that hosted more than a thousand users and i had, say the interface list up or the pppoe list up it would generate about two mbit or so of regular winbox traffic.
That’s basically because so much statistics data is sent over the tcp connection that simply generated this much. I advise you to keep the windows you don’t need, closed.
Disabling or removing the security package could help you reduce the load on the router (so it wont affect the flow of traffic for the customers so much).
Even though the winbox connection does not appear to be sending data with network efficiently in mind it is more than likely very efficient internally on the router which is, in this case, more important. Some form of optional LZW/LZS compression support would probably help but it would add to the CPU load which is unfavorable for the low powered routers.
I once made an LZW implementation for study in x86 asm (way back when) and even though you can implement it without floating point arithmetic you still have a really massive amount of string compares which is really expensive.
use net-peeker on your client windows machine to see whether it is winbox.exe that is downloading that traffic or something else.