RT-AX88U maxing out a core and regularly showing 60+ MB/s upload

[sorachan]

It's AiCloud.


No they're not because the firewall blocks access to them. The use of 0.0.0.0 is common practice (and often a necessity) when dealing with dynamic network interfaces.

But that does raise an interesting point... @kknishev @firecracker If the problem reoccurs can you post the same information as before together with the output of iptables-save. Thanks.

You are right, but not everyone enables firewall, and you'd be surprised how many don't.

I know a certain proxy program used in some certain countries running on ASUS routers which listens to 0.0.0.0:***** (I'm not going to disclose the port number). The program includes a socks5 proxy tunnel.

I also know since last year there has been a script that actively scans for this port number to take advantage of this socks5 proxy.

 

[ColinTaylor]

You are right, but not everyone enables firewall, and you'd be surprised how many don't.

True. Quite often it's gamer kiddies that think it's going to improve their gameplay in some. way. But you can't account for user stupidity.

I know a certain proxy program used in some certain countries running on ASUS routers which listen to 0.0.0.0:***** (I'm not going to disclose the port number). The program includes a socks5 proxy tunnel.

I also know since last year there is a script that actively scans for this port number to take advantage of this socks5 proxy.

Installing third party software is always a risk. If that software compromises your whole router (rather then opening a single port in the firewall) then it's the responsibly of the user.

 

[sorachan]

@ColinTaylor Thanks for answering my silly question

 

[Ripshod]

@ColinTaylor Thanks for answering my silly question

Never a silly question. If it occured to you it likely would occur to thousands of others. It's not always the direct answers that educate. We're all learning.

 

[kknishev]

If the problem reoccurs

yes, you knew .. attached (replaced public ip with 000.000.000.000)

 

[Armand28]

I changed password, turned off SSH, rolled back and then rolled forward to latest Merlin firmware. Should I turn off DDNS? Is that any part of this equation or can I leave it on? Thanks!

 

[jd24]

I changed password, turned off SSH, rolled back and then rolled forward to latest Merlin firmware. Should I turn off DDNS? Is that any part of this equation or can I leave it on? Thanks!

I have ddns turned off for now, just testing. OpenVPN On (new config/cert created) though and still no issues for 24 hours.

 

[firecracker]

@kknishev @firecracker can you run those commands again while the CPU problem is actually occurring. Thanks.

It hasn't happened again since about 10AM today.

I found a strange entry in the log file though.

Any idea what "Tainted" means in this context? Also, first time I've seen "sshd" in the log file as well.

 

[Martinski]

..
I found a strange entry in the log file though.
...
Any idea what "Tainted" means in this context? Also, first time I've seen "sshd" in the log file as well.

In general terms, the string "Tainted:" (usually followed by a series of one-letter "taint flags") in a crash report means that the kernel has been marked and is considered to be in an "unknown state" (i.e. "tainted state") because a possibly non-native component was loaded & later crashed which puts the kernel in an unreliable state. Most of the time, this is caused by loading & running an externally compiled or unsigned proprietary module. As a result, the reported crash cannot be debugged by kernel developers because the source code of the external module is not included with or part of the Linux kernel source code (i.e. an "out-of-tree" component).

In your screenshot of the crash report you can see 2 taint flags:

P = A proprietary module was loaded/running.

O = An "out-of-tree" external module was loaded/running.

HTH.