Firewall · Topic 5 of 7

Detecting an Attack on Critical Infrastructure Services

Learn how to spot an attack on services such as DNS or web on RouterOS using counters, logging, Torch, the profiler and address lists, then respond.

5 min

In a nutshell

Detection starts with knowing the normal traffic and load.
Torch shows live traffic by source, destination, protocol and port.
/tool profile shows which process is using the CPU.

What it is

Detecting an attack means noticing that traffic or load is not normal before users start to complain.

Critical infrastructure services are the ones that everything else depends on. DNS, DHCP, time, web and remote access are typical examples.

You cannot spot unusual traffic unless you know what normal looks like. A baseline of traffic rates, CPU load and connection counts is the starting point.

How it works

RouterOS gives several tools that show what is arriving, and the firewall can record and react to it.

Signs of an attack

Look for sudden changes in the following places.

Very high CPU load on the router.
A large rise in the number of tracked connections.
Interface traffic that is far above the usual level.
Many packets from one source or to one port.
Log lines about failed logins or dropped packets that repeat quickly.

Tools that show the traffic

Tool	What it shows
`/interface monitor-traffic`	Live rate on an interface
`/tool torch`	Live traffic by address, protocol and port
`/ip firewall connection print`	The tracked connections
`/system resource print`	CPU, memory and uptime
`/tool profile`	Which router process uses the CPU
Firewall rule counters	How many packets matched each rule

/interface monitor-traffic ether1
/tool torch interface=ether1 src-address=0.0.0.0/0 dst-address=0.0.0.0/0
/ip firewall connection print count-only
/tool profile

Torch is the quickest way to find the busiest source address or the targeted port. The profile tool tells you whether the load is in the firewall, in routing or somewhere else.

Counting with the firewall

Every rule counts the packets and bytes that match it. A rule with the action passthrough can be used purely as a counter.

/ip firewall filter add chain=input protocol=udp dst-port=53 in-interface=ether1 action=passthrough comment="dns from wan"
/ip firewall filter print stats
/ip firewall filter reset-counters

Reset the counters, wait a known time, and read them again. The difference gives you a rate.

Logging and address lists

A log rule writes a line for matching packets. A rate limit in front of it keeps the log readable.

/ip firewall filter add chain=input protocol=tcp dst-port=80 connection-limit=100,32 action=add-src-to-address-list address-list=heavy-users address-list-timeout=1d
/ip firewall filter add chain=input protocol=tcp dst-port=80 src-address-list=heavy-users action=log log-prefix="heavy"

The connection-limit matcher is given as a number and a netmask. The numbers and the timeout here are example values. The first rule here marks sources that hold many connections to the web service, and the second rule logs their packets.

Protect critical services

The next step is to remove what an attacker does not need. A router that gives DNS service to the LAN should not answer outside queries.

/ip dns set allow-remote-requests=yes
/ip firewall filter add chain=input in-interface=ether1 protocol=udp dst-port=53 action=drop
/ip firewall filter add chain=input in-interface=ether1 protocol=tcp dst-port=53 action=drop

An open resolver can be used by attackers to flood a third party. The two drop rules close it on the outside interface.

For servers behind the router, use rate limits on the forward chain and a drop rule for sources in the blocked lists. Send logs to a remote server so that they survive if the router is overloaded.

Exam tip

Write down the normal CPU load and traffic rate of a healthy network. Without that baseline, a rise in load is only a guess.

What to remember for the exam

Seven facts summarise detection.

Detection starts with knowing the normal traffic and load.
Torch shows live traffic by source, destination, protocol and port.
/tool profile shows which process is using the CPU.
A passthrough rule is a counter, and reset-counters clears the counts.
Address lists with a timeout collect suspicious sources automatically.
A log rule with a prefix makes events easy to find.
Do not let outside hosts use the router as a DNS resolver.

Common mistakes

Four mistakes are typical.

Logging everything. A rule that logs every packet fills the memory and hides real events, so add a limit or a narrow match.

Having no baseline. Without a normal reference you cannot say if a number is high.

Leaving remote DNS open. The router then helps attackers to flood others, and it uses its own resources to do it.

Keeping the only copy of logs on the router. A busy router may lose them. Send them to another host.

Watch out

Running Torch or logging on a router that is already at full load can make the load worse. Use narrow filters and stop the tool when you have what you need.

Check yourself

Work through these three questions.

Which tool shows live traffic by source address, protocol and port?
/tool torch does this. It helps you find the busiest source or the targeted port.
How can a firewall rule be used only as a counter?
Use the action passthrough. The rule counts matching packets and then the packet carries on to the next rule.
Why should the router not answer DNS queries from the outside interface?
An open resolver can be used to flood a third party and it uses the router's resources. Drop outside DNS on the input chain.

Topic 5 of 7 in Firewall

Test yourself on Firewall

The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.