# sep/18/2017 16:23:14 by RouterOS 6.31
# software id = HZ4Z-****

Running RouterBoad 850Gx2.

When I use Winbox and click on interfaces->my-ether1-wan and view the traffic graph I see constant RX traffic of 70 kbits per second (about 120 packets per second)

This is when all my hosts are shut down except for the Windows 10 PC running Winbox.

I have added some passthrough statements at the top of the firewall to see what type of traffic it is and where is is destined but the counters don't show the 70 kbits.

How can I find the source of this traffic? It does not seem to be showing in my accounting records on my ISP. ISP is Rogers using DHCP.

Is it ARP overhead. Seems like a lot of constant stuff.

Anyone seen similar issues.

Thanks in advance.

Other traffic from customers on the same node as you. Probably all ARP and DHCP.

So I added a passthrough rule near the top of the firewall table to count and log UDP dhcp packets (dst port = 67) but nothing seen.

So I guess it is ARP. But why would ARP from the ISP node be going through the Rogers Hitron modem (in bridged mode) too the MikroTik ?

Normal ?

The packets are not addressed to you, so the firewall does not process them. And you answered your own question - the modem is in bridge mode, so it passes any traffic from the HFC network to your Mikrotik.