High RAM usage seemingly causing WiFi to not function

[sneak]

Router is an ASUS RT-BE86U with Merlin Firmware 3006.102.3

Things were fine last night, though a couple times I noticed short connection losses when trying to load websites. I woke up this morning and my phone was disconnected from the WiFi network and wouldn't connect. Tested on laptop and saw same result. The lights on the router and modem indicated normal operation.

It took a very long time to load the login page for the router. Then it took a long time to login, and a long time to load all of the UI. I noticed immediately the RAM usage was oddly high.

Every page I try to load takes a very long time to load, and I get prompts from my browser asking if I want to wait or leave the page because it isn't responding.

I also found these details:

I don't have time to wait around for page loads and figure this out right now as I have to work so I reboot the router. I'm now able to connect via WiFi again and pages for the router are loading quickly again. Going forward I'm wondering what I can do to find out why this happened, and what I can do to stop it from happening again. I guess a simple bandage is to setup some kind of automated reboot of the router, but I'd prefer an actual fix.

 

[John Fitzgerald]

You didn't explain your networking setup or any add-on scripts that maybe affecting your situation.
There is newer Firmware and a current testing Alpha build that you may want to try first.
There are known bugs in the Firmware which are searchable.

 

[dave14305]

The CPU load average is very high, so it seems like something was running and consuming CPU and memory.

 

[bennor]

Router is an ASUS RT-BE86U with Merlin Firmware 3006.102.3

I noticed immediately the RAM usage was oddly high.

Do you have a USB drive attached to the router? And are you using that drive as local file storage/media server (i.e. reading and writing files to it)? Do you have any third party script loaded? If so which ones?

If you have a USB drive attached and are using it for file storage then high RAM usage is common. SMB/Samba access to that drive can lead to high RAM usage, and there are a number of past posts about the issue. There are some workarounds if you don't want to stop using the drive as file storage. First is to clear the router's cache. Various ways to do so using SSH to access the router and run a line of code. Here are some examples:

sync; echo 1 > /proc/sys/vm/drop_caches
or
sync && echo 3 > /proc/sys/vm/drop_caches
or
free && sync && echo 3 > /proc/sys/vm/drop_caches && free

Some have resorted to creating a CRON job to clear the cache at specific times. See this post.

Otherwise one can setup a router reboot schedule to reboot the router every couple of days.

To find out what is hogging the processor one can access the router using SSH and run top to see what processes and services are running and consuming resources.

 

[sneak]

You didn't explain your networking setup or any add-on scripts that maybe affecting your situation.
There is newer Firmware and a current testing Alpha build that you may want to try first.
There are known bugs in the Firmware which are searchable.

I did check the changelog for the new version and saw nothing about this.

I have no add-on scripts.

Hitron CODA56.
TRENDnet TEG-25GECTX in computer. Router connecfted to this NIC.
Other ports: 1 goes to work PC, 2 go to NAS (2.5 GbE ports), 1 goes to a TP-Link TL-SG605.
Switch had 1 of the same work PCs connected to it for 5 days last week while someone stayed with me. Now it just has my work PC connected to it since I haven't plugged my work PC back directly into the router yet.

The CPU load average is very high, so it seems like something was running and consuming CPU and memory.

All I can think of is an RSS automatic download on qbittorrent, but this has never happened before.

Do you have a USB drive attached to the router? And are you using that drive as local file storage/media server (i.e. reading and writing files to it)? Do you have any third party script loaded? If so which ones?

If you have a USB drive attached and are using it for file storage then high RAM usage is common. SMB/Samba access to that drive can lead to high RAM usage, and there are a number of past posts about the issue. There are some workarounds if you don't want to stop using the drive as file storage. First is to clear the router's cache. Various ways to do so using SSH to access the router and run a line of code. Here are some examples:

sync; echo 1 > /proc/sys/vm/drop_caches
or
sync && echo 3 > /proc/sys/vm/drop_caches
or
free && sync && echo 3 > /proc/sys/vm/drop_caches && free

Some have resorted to creating a CRON job to clear the cache at specific times. See this post.

Otherwise one can setup a router reboot schedule to reboot the router every couple of days.

To find out what is hogging the processor one can access the router using SSH and run top to see what processes and services are running and consuming resources.

No USB/storage/media/scripts.

I guess next time I see such usage I'll use top (or install htop )

 

[ColinTaylor]

@bennor See his screenshot. This is not the "usual" RAM problem. drop_caches won't help in this case.

 

[dave14305]

All I can think of is an RSS automatic download on qbittorrent, but this has never happened before.

This would need to be something running directly on the router.

Enable SSH on the LAN only, and if it happens again, attempt to SSH to the router (assuming it responds), and run this to capture the current utilization:

top -b -n 1

 

[sneak]

This would need to be something running directly on the router.

Enable SSH on the LAN only, and if it happens again, attempt to SSH to the router (assuming it responds), and run this to capture the current utilization:

top -b -n 1

Thanks. I'll try it if necessary.

 

[Ripshod]

@sneak how long have you had this router in this configuration? Can you confirm link aggregation (using LACP) is correctly configured at the NAS and the router?

 

[sneak]

@sneak how long have you had this router in this configuration? Can you confirm link aggregation (using LACP) is correctly configured at the NAS?

I've had this router in this configuration since either end of Jan or early Feb 2025.

 

[John Fitzgerald]

I've had this router in this configuration since either end of Jan or early Feb 2025.

Switch had 1 of the same work PCs connected to it for 5 days last week while someone stayed with me. Now it just has my work PC connected to it since I haven't plugged my work PC back directly into the router yet.

So always need to ask everyone that's gone from stock firmware to rmerlin's is if you performed a factory reset after the conversion AND loaded your settings from scratch; and yes I saw this was configured in Jan-Feb, 2025.

This is so everyone replying doesn't have to grasp at straws.

AND for the gallery: Do you think this only happened after the coworker left or maybe while they were staying with you? (unclear if you think this is work related or not?)

 

[sneak]

So always need to ask everyone that's gone from stock firmware to rmerlin's is if you performed a factory reset after the conversion AND loaded your settings from scratch; and yes I saw this was configured in Jan-Feb, 2025.

This is so everyone replying doesn't have to grasp at straws.

AND for the gallery: Do you think this only happened after the coworker left or maybe while they were staying with you? (unclear if you think this is work related or not?)

I don't believe I did a factory reset after flashing merlin, but it was also a brand new router without a bunch of tweaks to settings. Not sure if that matters, but I did come across people saying something about that during brief research before posting this thread.

I don't think it's related to the coworker whatsoever. I was just explaining why I have a switch that is effectively going to only 1 computer, defeating the need for the switch to exist in the chain at all... since I can just plug the computer into the port where the switch is currently.

 

[dave14305]

Thanks. I'll try it if necessary.

Run it now to establish the “normal baseline”. If this is a slow buildup of memory or processes it may be visible over time.

 

[John Fitzgerald]

I don't believe I did a factory reset after flashing merlin, but it was also a brand new router without a bunch of tweaks to settings. Not sure if that matters, but I did come across people saying something about that during brief research before posting this thread.

I don't think it's related to the coworker whatsoever. I was just explaining why I have a switch that is effectively going to only 1 computer, defeating the need for the switch to exist in the chain at all... since I can just plug the computer into the port where the switch is currently.

Weird things can go wrong if not factory reset. Sometimes you can get lucky and restore a backup after a factory reset but it's not the best because restoring old problems can occur.

Follow @dave14305 's advice from post#13.

Any VPN's in common with coworker?

Just spitballing: Do you think the switch could be the issue?

 

[sneak]

Run it now to establish the “normal baseline”. If this is a slow buildup of memory or processes it may be visible over time.

I did, actually. I just did it again to post here and truncated the list where the decimals for what appears to be %VSZ are 0.0.

@RT-BE86U-6588:/tmp/home/root# top -b -n 1
Mem: 636780K used, 380520K free, 3928K shrd, 13152K buff, 59364K cached
CPU:  0.0% usr  0.0% sys  0.0% nic  100% idle  0.0% io  0.0% irq  0.0% sirq
Load average: 0.28 0.33 0.30 1/192 30741
  PID  PPID USER     STAT   VSZ %VSZ CPU %CPU COMMAND
 5668     1 username    S    21656  2.1   1  0.0 wred -B
 4759     1 username    S    21416  2.0   2  0.0 amas_lib
 4718     1 username    S    20496  2.0   0  0.0 conn_diag
 3867     1 username    S    20352  1.9   1  0.0 roamast
 4736  4718 username    S    19268  1.8   2  0.0 amas_portstatus
 4741     1 username    S    18236  1.7   0  0.0 cfg_server
21495     1 username    S <  17172  1.6   1  0.0 dcd -i 3600 -p 43200 -b -d /tmp/bw                                          dpi/
 3654     1 username    S    16192  1.5   1  0.0 /sbin/netool
    1     0 username    S    16136  1.5   3  0.0 /sbin/init
 3820     1 username    S    15560  1.5   0  0.0 networkmap --bootwait
10474     1 username    S    15384  1.5   1  0.0 /usr/sbin/dnsqd
 3878     1 username    S    14984  1.4   3  0.0 /usr/sbin/uamsrv -f /tmp/uamsrv.co                                          nf -D
 3652     1 username    S    14248  1.3   0  0.0 nt_monitor
 3797     1 username    S    14140  1.3   0  0.0 watchdog
 2644     1 username    S    14140  1.3   2  0.0 /sbin/wanduck
 4897     1 username    S    14140  1.3   0  0.0 usbled
 8208     1 username    S    14140  1.3   3  0.0 bwdpi_wred_alive
 4765     1 username    S    14140  1.3   2  0.0 sched_daemon
 3800     1 username    S    14140  1.3   0  0.0 amas_lanctrl
 3836     1 username    S    14140  1.3   3  0.0 pctime
 3831     1 username    S    14140  1.3   3  0.0 dns_dpi_check
 3732     1 username    S    14140  1.3   0  0.0 wpsaide
 3825     1 username    S    14140  1.3   2  0.0 bwdpi_check
 4719     1 username    S    14140  1.3   3  0.0 amas_ssd_cd
 4760     1 username    S    14140  1.3   0  0.0 nbr_monitor
 5585     1 username    S    14140  1.3   2  0.0 disk_monitor
32383  3797 username    S    14140  1.3   1  0.0 hour_monitor
 3824     1 username    S    13012  1.2   1  0.0 mastiff
 3793     1 username    S    12564  1.2   0  0.0 httpd -i br0
 3667     1 username    S    12224  1.1   1  0.0 nt_center
 3647     1 username    S    11148  1.0   0  0.0 asd
 3736     1 username    S    10412  1.0   2  0.0 /usr/sbin/awsiot
 6140     1 username    S    10320  1.0   3  0.0 /usr/sbin/smbd -D -s /etc/smb.conf
 3701     1 username    S    10100  0.9   3  0.0 /usr/sbin/acsd2
 6134     1 username    S    10040  0.9   1  0.0 /usr/sbin/nmbd -D -s /etc/smb.conf
 3731     1 username    S     9988  0.9   0  0.0 wps_pbcd
 6135  6134 username    S     9760  0.9   2  0.0 /usr/sbin/nmbd -D -s /etc/smb.conf
 3709     1 username    S     8764  0.8   2  0.0 hostapd /tmp/wl0_hapd.conf /tmp/wl                                          1_hapd.conf -B
 4898     1 username    S     7984  0.7   2  0.0 usbmuxd
 3794     1 username    S     7364  0.7   3  0.0 /usr/sbin/infosvr br0
 3653     1 username    S     7204  0.7   1  0.0 protect_srv
 6110     1 username    S     6400  0.6   1  0.0 /usr/sbin/stubby -C /etc/stubby/st                                          ubby-0.yml
 3750     1 username    S     5636  0.5   0  0.0 /usr/sbin/wlceventd
 3733     1 username    S     5084  0.5   2  0.0 /usr/sbin/wlc_nt
 3734     1 username    S     5068  0.4   1  0.0 /usr/sbin/wlc_monitor
 3688     1 username    S     5036  0.4   1  0.0 nt_actMail
 4773     1 username    S     4980  0.4   3  0.0 fsmd
 3799     1 username    S     4688  0.4   2  0.0 rstats
 3796     1 username    S     4228  0.4   2  0.0 sysstate
30377 31640 username    S     3908  0.3   2  0.0 dropbear -p 9262 -j -k
31632     1 username    S     3800  0.3   3  0.0 /usr/sbin/ntp -t -S /sbin/ntpd_syn                                          ced -p pool.ntp.org -p time.nist.gov
31640     1 username    S     3780  0.3   0  0.0 dropbear -p 9262 -j -k
 3752     1 username    S     3336  0.3   2  0.0 /usr/sbin/debug_monitor /data
 3664     1 username    S     3324  0.3   0  0.0 /bin/eapd
 3781     1 nobody   S     3284  0.3   1  0.0 avahi-daemon: running [RT-BE86U-65                                          88.local]
 4733  4729 nobody   S     3152  0.3   2  0.0 lldpd -L /usr/sbin/lldpcli -s RT-B                                          E86U
 4729     1 username    S     3152  0.3   2  0.0 lldpd -L /usr/sbin/lldpcli -s RT-B                                          E86U
31635     1 username    S     3116  0.3   0  0.0 /sbin/klogd -c 5
31633     1 username    S     3116  0.3   0  0.0 /sbin/syslogd -m 0 -S -O /jffs/sys                                          log.log -s 512 -l 6
 6163     1 username    S     3116  0.3   1  0.0 /sbin/udhcpc -i eth0 -p /var/run/u                                          dhcpc0.pid -s /tmp/udhcpc_wan -A5 -O33 -O249
30403 30377 username    S     3116  0.3   3  0.0 -sh
30741 30403 username    R     3116  0.3   2  0.0 top -b -n 1
31642     1 username    S     3116  0.3   2  0.0 crond -l 9
 6113     1 nobody   S     2664  0.2   3  0.0 dnsmasq --log-async
 6114  6113 username    S     2664  0.2   3  0.0 dnsmasq --log-async
 5603     1 username    S     2584  0.2   2  0.0 miniupnpd -f /etc/upnp/config -1
 3645     1 username    S     2408  0.2   0  0.0 /usr/sbin/haveged -r 0 -w 1024 -d                                           32 -i 32
  874     1 username    S     2204  0.2   0  0.0 /usr/sbin/envrams
 5006     1 username    S     2104  0.2   0  0.0 /bin/mcpd
 6144     1 username    S     1904  0.1   1  0.0 /usr/sbin/wsdd2 -d -w -i br0 -b sk                                          u:RT-BE86U,serial:<serial_was_here>
  820     1 username    S     1784  0.1   1  0.0 {wdtctl} wdtd
  824     1 username    S     1756  0.1   1  0.0 hotplug2 --persistent --no-coldplug

Weird things can go wrong if not factory reset. Sometimes you can get lucky and restore a backup after a factory reset but it's not the best because restoring old problems can occur.

Follow @dave14305 's advice from post#13.

Any VPN's in common with coworker?

Just spitballing: Do you think the switch could be the issue?

I guess it is possible the switch could be the issue, since it's the only new thing introduced really. And yes, we both use GlobalProtect for work.

 

[John Fitzgerald]

@sneak , thinking out loud : Has your computer been shut down and restarted since the coworker left? Which Windows, 10 or 11-24H2?? with GlobalProtect? (not that it should make any difference)

I'm thinking that you both were connected by VPN through the same switch on your home IP line and maybe the VPN has hiccuped once you separated and thinks you somehow are still in the same location and your router is getting hammered acting as a conduit. (being that is the new thing in the equation) (not that it should act this way)

OR the switch could be bad OR if you take it out and things go back to normal OR Win11-24H2 has had networking issues and maybe if you reset your network adapter all will come back (yes your phone stopped working also-- but thinking your computer is the hammer to the router???

 

[Ripshod]

I'm thinking switch too

 

[John Fitzgerald]

I'm thinking switch too

Lots of complaints also with W11-24H2 and VPN's.

 

[sneak]

@sneak , thinking out loud : Has your computer been shut down and restarted since the coworker left? Which Windows, 10 or 11-24H2?? with GlobalProtect? (not that it should make any difference)

I'm thinking that you both were connected by VPN through the same switch on your home IP line and maybe the VPN has hiccuped once you separated and thinks you somehow are still in the same location and your router is getting hammered acting as a conduit. (being that is the new thing in the equation) (not that it should act this way)

OR the switch could be bad OR if you take it out and things go back to normal OR Win11-24H2 has had networking issues and maybe if you reset your network adapter all will come back (yes your phone stopped working also-- but thinking your computer is the hammer to the router???

My personal computer is on 10 and my work computer is on 10 but the other work computer here last week is on 11. Not sure on more specific build information.

We both shut off the work computers each day and I actually only used my work computer Monday through Wednesday of last week.

 

[John Fitzgerald]

My personal computer is on 10 and my work computer is on 10 but the other work computer here last week is on 11. Not sure on more specific build information.

We both shut off the work computers each day and I actually only used my work computer Monday through Wednesday of last week.

Try power cycling the cable modem as well in case they pushed an update or some other ISP problem.