Looks like a lot of the connections are port 53. On Tue, Sep 6, 2016 at 11:59 AM, Mike Hammett <[email protected]> wrote:
> Torch? > > > > ----- > Mike Hammett > Intelligent Computing Solutions <http://www.ics-il.com/> > <https://www.facebook.com/ICSIL> > <https://plus.google.com/+IntelligentComputingSolutionsDeKalb> > <https://www.linkedin.com/company/intelligent-computing-solutions> > <https://twitter.com/ICSIL> > Midwest Internet Exchange <http://www.midwest-ix.com/> > <https://www.facebook.com/mdwestix> > <https://www.linkedin.com/company/midwest-internet-exchange> > <https://twitter.com/mdwestix> > The Brothers WISP <http://www.thebrotherswisp.com/> > <https://www.facebook.com/thebrotherswisp> > > > <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> > ------------------------------ > *From: *"Jason McKemie" <[email protected]> > *To: *[email protected] > *Sent: *Tuesday, September 6, 2016 11:57:33 AM > *Subject: *[AFMUG] Mikrotik Possibly Compromised > > So I've noticed some strange behavior on my home connection (Comcast). > The Mikrotik that I am using shows a constant Tx on the WAN port of around > 3-5Mbps and between 200-300pps, Rx is just a few kbps. This activity > appears to be strictly on the WAN port. If I disable a firewall rule that > accepts input, the activity ceases - but devices behind the router lose > connectivity. > > Any ideas? I've got all IP services disabled except winbox, which is > restricted to my local network. > >
