Community discussions

MUM Europe 2020
 
wnmuroki
just joined
Topic Author
Posts: 11
Joined: Wed Mar 30, 2011 1:48 pm

Checking unknown source of traffic

Mon Nov 19, 2012 5:03 pm

Hi all,

I've noticed something strange on my interfaces with the amount of traffic passing through ether1 and ether2. Please see images below.
Ether1 is configured with the ISP settings and ether2 is configured with 1 private IP address which I have queued.
From experience, ether1 Rx and ether2 Tx usually have almost about the same traffic. I need to check where the extra traffic is coming from and how to block it.
You do not have the required permissions to view the files attached to this post.
 
pospanko
Member Candidate
Member Candidate
Posts: 272
Joined: Sun Dec 18, 2005 4:23 pm

Re: Checking unknown source of traffic

Mon Nov 19, 2012 6:02 pm

You could use Tools->Torch to see what is happening on your interface...
Internet, Mikrotik & Network solutions
http://www.pro-ping.hr
 
wnmuroki
just joined
Topic Author
Posts: 11
Joined: Wed Mar 30, 2011 1:48 pm

Re: Checking unknown source of traffic

Tue Nov 27, 2012 4:55 pm

Hi, I've been able to see the unwanted traffic on the ether1 interface. How do I now drop this traffic so that is stops consuming my bandwidth?
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8327
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Checking unknown source of traffic

Tue Nov 27, 2012 5:16 pm

if the traffic reaches your interface - you cannot stop it, it's already there. you need to drop it somewhere at the source point
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
ammar83
just joined
Posts: 19
Joined: Thu Nov 24, 2011 2:00 pm

Re: Checking unknown source of traffic

Wed Jan 08, 2014 10:55 am

Hi Experts,

I face exactly the same issue on one of my routers and it looks like I am receiving traffic from an unknown sources to the Interface that has the Public IP of the router. Is that a kind of traffic flood attack? Is there any possible way to block them? I face this issue from time to time and I usually change the Public IP that I am using for my router to solve the problem. Any possible way to report these IPs?

Ammar.

Who is online

Users browsing this forum: camperg, Kampfwurst, uberdome, virtualdxs and 62 guests