XT8 unexpected upload traffic from the router

[Da22a1]

After noticing poor network reliability I've found that my router appears to be uploading massive amounts of data at about 50MB/s for periods of about 1min, stops for just under 1min, then starts uploading again.  When this happens there is no evidence of any device on the wireless or wired network uploading any data, which suggests it's the router doing this.  I have 3 XT8 devices in the mesh, but when this upload happens, it continues even if I switch off the other 2 nodes, so it's definitely the router doing it not one of the nodes.

Rebooting cures it for a while, but sometime later it starts again.

All devices are on the same FW and upto date with version 3.0.0.4.388_24668-gb5d7304.

It's like the router is launching a DoS attack on itself!

Any help or clues as to what might be wrong would be helpful. I haven't yet factory reset the device, that's my last resort.

[Alexw]

I've been experiencing the same issue originally described - rebooting from the app or the wall has not fixed this problem. Will try downgrading firmware 

[larsmjoh]

I'm also experiencing the same problem. I've noticed 3 of 4 cpu cores are churning at 100% when it happens... 

[Aureliannn_ASUS]

Hi @Da22a1 @Alexw @larsmjoh ,

Thank you for providing detailed information. 

We apologize for the inconvenience caused by the persistent traffic issue even after a factory reset.

To further assist you in resolving this issue, we would like to request the following information:

Router settings and issue reproduction:

1. Have you made any custom settings on your router, such as enabling QoS, VPN, or other advanced features?
2. Please describe the situation in detail: What are you doing when the traffic issue occurs? How frequently does this happen? If you are experiencing a CPU 100% issue, please provide a screenshot for our reference.

Network environment:

1. Please provide information about your current network environment, such as:
2. Are you using ADSL, fiber optic, or other broadband connections?
3. How many devices are connected to your network?
4. Are you using a wireless or wired network?
5. If possible, please provide a network diagram for a clearer understanding of your network configuration.

System report:

To help us diagnose the issue more efficiently, please submit a system report via your router's web management interface when the problem occurs.
Steps:

• Connect your device to the router and open the web management interface (http://router.asus.com/) and log in to your router.
• Click "System Administration" and then "Problem Report".
• Fill in your region, email address (required), ASUS service/case number (if any), problem type, and problem description.
• Please read and agree to the privacy policy and terms of service.
• Click "Submit" to send your form.

Additionally, please provide the following information in a private message:

1. Product serial number
2. Time of the problem report submission
3. Email address used for the problem report
4. Time when the issue occurred

We will analyze the information you provide. Thank you for your patience and cooperation!

[larsmjoh]

Yes, I have made customizations, regarding ipv6, dhcp, ddns, smb and qos.

I am not doing anything in particular, it is entirely spontaneous. High burst of outgoing network traffic without any corresponding LAN traffic, coinciding with 100% CPU utilization on 3 our of 4 cores, persisting for about a minute. Then a slightly longer period of idling followed by another burst. The pattern then repeats. Restarting the router, there is a brief period of 15-30 minutes before the pattern resumes.

I have a fiber optic connection at 250Mbps symetric. 5 wired devices (cat6 cabling and a 10Gbps switch) and a dozen or so wireless devices spread over all three frequency bands.

Truning of all AiCloud functions and restarting the router seems to have solved the issue.

[okna2003]

Your device is hacked. There are many similar messages on other forums. Moreover, Asus is aware of this. Solution: full reset of the device (and manual reconfiguration). Attention! Do not use Asus services (AiDisk, AiCloud, DDNS). It is very likely that they are the source of penetration. Some router models permanently lose Wi-Fi data, MAC addresses after rebooting. They can only be restored under the service conditions.