About a week ago, I lost connectivity at my core. My core router became virtually inaccessible. I could only log on remotely for a couple of seconds before I would get kicked. Once I got onsite, it was still the same way. I could log in for just a couple of seconds before I would get booted.
I could not create a support file. The only tidbits of info I retrieved is that the cpu was at 100% and I took a screenshot of the log.
I also noticed the wan port of my RB1100 was totally saturated, even though the traffic was going nowhere.
I rebooted the RB1100 and as soon as it came back up the same thing happened. I unplugged the wan port and the router was accessible again. I replugged the wan port and the issue would happen again. I took my ip off the wan port and my router then stayed functional. When I torched the wan port, I saw that the bulk of the traffic was coming from quite a few different ip's but I did not get a screenshot.
I rebooted the router once again along with the fiber converter that's in between my RB1100 and the fiber connection from my isp.
When it came back up the last time, things were back to normal.
I attached the screenshot of my log and the only thing it shows is a BFD error? Does that tell a person anything?
Is there a way to tell if the traffic was from an attack? Could a faulty network component cause the issue I was having. My isp said they did see my traffic spike through their network when the issue happened so it wasn't some false reading that I was getting.