RT-AX88U maxing out a core and regularly showing 60+ MB/s upload

[jd24]

If you have the "sshd" process running, under normal circumstances that would be the OpenSSH server daemon (i.e. /opt/sbin/sshd) which can be installed via Entware (it's *not* built-in as part of the F/W).

View attachment 61858

View attachment 61859

However, if you have *not* explicitly installed the Entware package yourself, then someone or something else may have installed it, likely for nefarious purposes. I'd suggest you remove the OpenSSH package immediately. It may even be a "compromised" version of the OpenSSH server that has been installed by some malware.

Try the following commands to remove the package (if it exists):

{
   opkg list-installed | grep openssh ; echo
   opkg remove --force-removal-of-dependent-packages openssh-server
   opkg list-installed | grep openssh ; echo
}

My 2 cents.

Sorry how do I run this if opkg is not found?

I'm experiencing the same issues again after some hours

 

[ColinTaylor]

Sorry how do I run this if opkg is not found?

If opkg is not found then you don't have Entware installed, and therefore you also don't have the Entware openssh package.

 

[jd24]

I've been thinking of dropping in a dedicated vpn box like the tplink R605 omada or TL-ER7206
If this issue continues may throw this in between the bridge and my asus. (or initially just remove the asus and add the R605 as vpn and dhcp.)

 

[kknishev]

now {sshd} come back on 388.7

it's annoying that the router can work well with 0-2% CPU load for a long time, and then these surges

 

[Ripshod]

now {sshd} come back on 388.7
View attachment 61937

it's annoying that the router can work well with 0-2% CPU load for a long time, and then these surges

You need to find out what device on your network has been compromised, or this will drive you mad. You have reset the router and set up from scratch with new passwords after firmware changes of course(?).
Do you use a USB drive? This will need formatting too.
An afterthought: Are you using the built-in amtm or installing it from the repository (old, superceded method)?

 

[kknishev]

You need to find out what device on your network has been compromised, or this will drive you mad. You have reset the router and set up from scratch with new passwords after firmware changes of course(?).

Am I right that you think it's not a router issue but the someone of clients? It's my home network and I know each device...
I use mesh(eth) ax86u+ax56u with loading Merlin -> factory reset -> restore config (without change passwords and so on). Also I unplug usb-flash with mnt disk for ftp.

 

[ColinTaylor]

now {sshd} come back on 388.7

Please run these commands and post all the output (copy and paste all the text, do not post screenshots):

top -bn 1
netstat -nlp