Constant high incoming WAN traffic, should I be concerned?

[Kaiser]

Hi,

I have a set-up with Asus RT-NT66U router. Lately, its performance has been choppy every now and then. While trying to figure out what's going on, I realized that there is constant high incoming WAN traffic, app 2500-4000KB/s going on (according to Asus' own Traffic Monitor), see pic.

It's only incoming and it doesn't go through to any of my devices. If I turn off wireless and physically disconnect all wired devices, the incoming WAN traffic is still the same... The router has latest firmware and I have rebooted it, but no difference...

Should I be concerned about this? Is it a hacking attack and if so, can I do anything about it? Or is it something else? And, if so can it explain choppy performance?

Thanks!
MP

 

[thiggins]

Could be you have an open port that is attracting attention. Run a port scan to check.
https://www.grc.com/x/ne.dll?rh1dkyd2

 

[RMerlin]

Make sure your firmware is up-to-date, so your router hasn't been compromised.

Also if you have Download Master installed, double check its configuration. It might be sharing any plugged USB disk to the rest of the world.

 

[Kaiser]

Thank you for your answers!
Unfortunatelly, no difference yet...
www.grc.com reports all greens and a lot of "true stealth"...
Don't have Download Master, latest firmware is installed...

 

[RMerlin]

Does your ISP traffic report matches the numbers reported by the router?

You could also try disabling hardware NAT acceleration under LAN -> Switch to ensure it's not an erroneous report by the Traffic Monitor (which isn't compatible with NAT acceleration).

 

[Gar]

Could be you have an open port that is attracting attention. Run a port scan to check.
https://www.grc.com/x/ne.dll?rh1dkyd2

I tried to follow this link and got stopped with a "Shields Up" warning? It would only let me go back.

 

[ColinTaylor]

I tried to follow this link and got stopped with a "Shields Up" warning? It would only let me go back.

Try this: https://www.grc.com/x/ne.dll?bh0bkyd2

 

[Gar]

awesome, that was interesting. i had good results with no responses.

 

[Kaiser]

Does your ISP traffic report matches the numbers reported by the router?

You could also try disabling hardware NAT acceleration under LAN -> Switch to ensure it's not an erroneous report by the Traffic Monitor (which isn't compatible with NAT acceleration).

I don't really know how to see the ISP traffic report...

NAT acceleration is disabled...

 

[RMerlin]

I don't really know how to see the ISP traffic report...

Depends on your ISP. Some will provide a web portal allowing you to monitor your monthly usage (especially if they come with monthly traffic caps).