Router abnormal behavior cpu

[alpha45]

This is a first result hoping it will help.
There seems to be a problem with netstat -n instruction that I honestly don't know ..
Because when the CPU consumption is normal, netstat -n is not displayed.

 

[PeterV]

It's look like, I have a possible answer
if you have enabled AIProtection - please disable it, and check what is happened

P.S. I fount netstat -nl inside the dcd binary, and another topic with it https://www.snbforums.com/threads/asus-rt-ac88u-netstat-nl-cpu-usage.57464/

 

[alpha45]

/

I disabled AiProtection but the CPU engagement problem remained ..

 

[L&LD]

I disabled AiProtection but the CPU engagement problem remained ..

Even after a reboot?

 

[Natey2]

Try a kill -9 on that netstat pid and see if the CPU load goes down and stays down?

Sent using Tapatalk

 

[alpha45]

Even after a reboot?

Yes

Try a kill -9 on that netstat pid and see if the CPU load goes down and stays down?

In other words, how should the instructions be?
kill -9?
I thank

 

[miroco]

Based on your screenshot, it would be;

# kill -9 18147

https://www.linux.com/tutorials/how-kill-process-command-line/

 

[alpha45]

Based on your screenshot, it would be;
# kill -9 18147
https://www.linux.com/tutorials/how-kill-process-command-line/

But should this command be given using PuTTy?
At this time the netstate -nl entry in PuTTy does not appear.
Tank you

 

[miroco]

Run "top" as before and based on that information you kill netstat. Yes, all is done using putty.

View the previously posted link with linux tutorials.

 

[alpha45]

Run "top" as before and based on that information you kill netstat. Yes, all is done using putty.
View the previously posted link with linux tutorials.

The router went all day without problems, but a few minutes ago the processor started to go bad.
I used your advice and immediately the cpu is back to normal as you can see from the attachment.
But how do you see the PID is different from yesterday and if the PID changes, the problem will occur again?
Thanks

 

[miroco]

This is not a solution. If you read the link @PeterV posted, it points a finger to AiProtection by Trend Micro. Since you are using AiProtection, you could try to disable the service. If the problem disappear when the service is disabled and reappear when it's enabled, it's a strong indication that AiProtection is the culprit. Don't forget to follow @L&LDs advice to reboot your router between trials (toggling AiProtection on/off). If you discover that AiProtection is indeed the culprit, you could do as many forum member does - stay away from the bundled Trend Micro software.

Check out:

Skynet - Router Firewall & Security Enhancements
https://www.snbforums.com/threads/release-skynet-router-firewall-security-enhancements.16798/

Diversion - the Router Ad-Blocker
https://www.snbforums.com/threads/diversion-the-router-ad-blocker.48538/

AMTM - the Asuswrt-Merlin Terminal Menu
Amtm is a shortcut manager for popular scripts for wireless routers running on Asuswrt-Merlin firmware.
https://www.snbforums.com/threads/amtm-the-snbforum-asuswrt-merlin-terminal-menu.42415/

A step-by-step guide how to set up a USB drive for Asus Merlin based routers
https://www.snbforums.com/threads/amtm-step-by-step-install-guide-l-ld.56237/#post-483421

 

[alpha45]

This is not a solution.

I thank you for the answer and for the time you dedicate to me,
I am sorry that this is not a solution!
This morning it was still cpu with high consumption.
I disabled AiProtection and restarted the router from Gui. (We'll see)
Before disabling I had seen that it had blocked 32 malicious sites ...
Now who blocks possible sites (the modemwhat I connected upstream?)
If I had to restore the original fw would I have the same problems?
I don't use usb or anything else on the modem, only PC and WiFi!
Unfortunately, I apologize if sometimes I don't understand, but I'm 74 ...
Thanks for understanding.

P.S. While I am writing to you I have checked the cpu and still with problems, but can't you guess the cause of the problem?I attach the log.

 

[dave14305]

I thank you for the answer and for the time you dedicate to me,
I am sorry that this is not a solution!
This morning it was still cpu with high consumption.
I disabled AiProtection and restarted the router from Gui. (We'll see)
Before disabling I had seen that it had blocked 32 malicious sites ...
Now who blocks possible sites (the modemwhat I connected upstream?)
If I had to restore the original fw would I have the same problems?
I don't use usb or anything else on the modem, only PC and WiFi!
Unfortunately, I apologize if sometimes I don't understand, but I'm 74 ...
Thanks for understanding.

P.S. While I am writing to you I have checked the cpu and still with problems, but can't you guess the cause of the problem?I attach the log.

Can you run this variation of the top command as well? I'm curious what the parent process ID (PPID) belongs to. Need to trace the "lineage" of the netstat process as it's happening.

top -bn 2

 

[miroco]

I would not recommend reverting to an older firmware version. They are constantly upgraded, in part to fix security flaws. Adding features, improving performance, fixing security flaws and "bugs" are in my view the most important reasons for any software upgrade. In a tradeoff between performance and security (felt or real), it's maybe best you continue with AiProtection enabled.

https://en.wikipedia.org/wiki/Software_bug

https://www.snbforums.com/threads/high-ram-usage-rt-ac86u.50070/page-2#post-519652

Edit.
The changelog tells you what's changed between versions.
https://www.asuswrt-merlin.net/changelog-382

 

[Natey2]

... it points a finger to AiProtection by Trend Micro.

I use stock Asus firmware with AIProtection and all the analytics features (that latter is why I bought the Asus router) and I don't have a problem with high CPU.

I'll post my netstat (on stock) for comparison with the OP's, if that will help.

Sent using Tapatalk

 

[Natey2]

I am sorry that this is not a solution!

Man, I was about to write a shell script that greps "netstat" and kills it, which runs as a cron job every minute [emoji23]

(Just kidding, of course)

Sent using Tapatalk

 

[alpha45]

Can you run this variation of the top command as well? I'm curious what the parent process ID (PPID) belongs to. Need to trace the "lineage" of the netstat process as it's happening.

top -bn 2

​

That's what I'd like too ...
As soon as the problem arises again, I'll let you know!
Hello

​

I would not recommend reverting to an older firmware version. They are constantly upgraded, in part to fix security flaws. Adding features, improving performance, fixing security flaws and "bugs" are in my view the most important reasons for any software upgrade. In a tradeoff between performance and security (felt or real), it's maybe best you continue with AiProtection enabled.

Thanks anyway!
Hello

Man, I was about to write a shell script that greps "netstat" and kills it, which runs as a cron job every minute [emoji23]
(Just kidding, of course)
Sent using Tapatalk

Sin is not true !!
But I think it's a feasible idea!
Hello

 

[alpha45]

Can you run this variation of the top command as well? I'm curious what the parent process ID (PPID) belongs to. Need to trace the "lineage" of the netstat process as it's happening.

top -bn 2

The one attached is the result.
We hope it's useful
Thanks

 

[dave14305]

The one attached is the result.
We hope it's useful
Thanks

It confirms that dcd is the source.

 

[dave14305]

You could withdraw consent for all Trend Micro services on the "Administration / Privacy" tab of the GUI. See if that neuters the netstat activity. Disabling AiProtection often isn't enough.