Where does TX traffic come from on the router if there is no RX?

Question

Computer networks

Hello dear!
I just have no direct guesses, can you tell me how? A friend sent a "screenshot", asked for help to figure it out.

There is a feeling that someone is downloading something directly from Mikrotik itself. But how is this possible?
ether-1 is the uplink. Behind him is an ADSL modem and the Internet, with a speed of just 10 Mbps.

Answer 1

close the firewall incoming 53 udp \ tcp from the outside world, leave it only inside the bridge

Answer 2

And there is also a wonderful Torch utility, with which you can see what kind of traffic is on the port. And yes, close DNSs

Answer 3

Why is there no RX? 200kbps.
Isn't this a member of a botnet? Is it DDos or a virus breaking?

Answer 4

Where does TX traffic come from on the router if there is no RX?

If I remember correctly, Tx is outgoing, Rx is incoming.
Where does outgoing traffic come from? It all depends on what kind of traffic is counted, it can be anything. ARP traffic, ICMP traffic and/or something else. Where does it get it from - at least the router itself can generate it.

Answer 5

Most likely, your router is being DDoSed via DNS Amplification. I had the same problem, on the test server the 1Gb / s channel was clogged at 100% and it was not possible to work, it was decided by completely closing port 53.