WinBox shows a CPU hovering near 100 percent, or simply sitting there. The router responds slowly, a speed test gets a fraction of your line, and sometimes traffic disappears with no error. Often it started after a change: VLANs added, QoS switched on, a second internet line.
What it is not: a CPU spike of a few seconds during boot, an export or a speed test is normal. And a router that is full because there is a loop in your network does not have a CPU problem, it has a loop. Check first whether something unusual is passing through.
The quick checks, in order
- How much is it really?
/system resource printshowscpu-load, the number of cores and the free memory. A good answer at a quiet moment is under 10 percent, and comfortably below 100 under load. - Where does the time go?
/tool profile duration=5. This is the most important command in this chapter. It shows the percentage per part. A lot in networking or firewall means your traffic goes through the CPU instead of around it. A lot in bridging points at traffic the switch chip is not handling. A lot in queue is your QoS, a lot in management is monitoring. - How much traffic is it anyway?
/interface monitor-traffic interface=ether1. 900 Mbit/s through a small board is an explanation. 20 Mbit/s with a full CPU is not, so keep looking. - Is FastTrack doing its job?
/ip firewall filter print stats. Find the rule with actionfasttrack-connection. A good answer is a counter climbing fast. If the rule is not there, or the counter stays at zero, every packet goes through the whole firewall. - Is traffic going through the switch chip?
/interface bridge port printand look at the offload state per port. Ports without offload are switched by the CPU. - How many connections are open?
/ip firewall connection print count-only. Tens of thousands of connections cost memory and cycles.
The usual causes, most common first
FastTrack is off because you use queues
FastTrack skips the firewall and the queues for known connections. That is exactly what makes it fast, and exactly why a queue cannot see that traffic. You cannot have both. Switch QoS on and FastTrack goes, and from then on every packet traverses the full firewall. On a small board you see that in the throughput immediately.
The trade-off: do the priorities matter more than the peak speed? Where bufferbloat is the problem, usually yes. On a line that simply has to fill up, no.
PCC load balancing over two lines
Same story: PCC works with mangle marks, which cannot be combined with FastTrack. Splitting traffic over two lines costs CPU.
VLAN filtering on a model whose switch chip does it differently
On the Atheros8327 and QCA8337 family the VLAN table lives in the switch chip, reached through /interface ethernet switch. Bridge VLAN filtering does work there, but it takes traffic off the switch chip and hands it to the CPU. A device that could switch at wire speed now does VLANs in software. This is the classic "it was faster before I introduced VLANs".
The board is simply small
A hAP lite or a hEX PoE lite has 64 MB of memory or less and a modest processor. RouterOS runs on it, but a long firewall, a queue tree, a big lease table and a second package fill it up. A device that runs out does not say so: it becomes slow, drops connections or reboots.
Something polls the router constantly
Monitoring that reads everything every five seconds, or a scheduler script that runs too often, costs more than you would think. You see it under management in /tool profile.
What the configurator does about it
- FastTrack is a toggle in the Firewall section, on by default, with the reason in its help text: it is automatically switched off when queues or PCC load balancing are active, because fasttracked traffic bypasses them. Turn QoS on and the script writes a comment in place of the rule.
- As soon as QoS is on, the tool warns: FastTrack is disabled in the firewall, which raises CPU load, and on small routers this costs throughput.
- Pick a queue tree with priorities on an older board and enter more than 200 Mbit/s, and the tool does the arithmetic for you: this router shapes in software and with FastTrack off it manages an estimated 200 to 300 Mbit/s, so the CPU becomes the bottleneck. With the suggestion to use fair sharing with CAKE or fq_codel instead: one queue, no mangle rules, far less CPU.
- Use VLANs on a model from the Atheros8327 or QCA8337 family and the tool states the price: the switch chip keeps its VLAN table in
/interface ethernet switch, this configuration uses bridge VLAN filtering, which works but turns hardware offload off, so VLAN traffic is forwarded by the CPU instead of the switch chip. - Hardware offloading (switch chip) is a toggle of its own in the Bridge & ports section, on by default. Leave it on.
- On models with little memory you get a note with the consequence attached: keep the configuration small, do not install packages you are not using, and check what is left with
/system resource print.
The honest limits
No setting makes a processor faster. FastTrack and hardware offload route traffic past the CPU, and the moment you do something that wants to see every packet, such as shaping or marking, that route is gone. That is not a shortcoming of RouterOS or of this program, it is the price of the feature. On a small board that price can be higher than the feature is worth, and then the honest conclusion is that the device is too small. What your router really manages is something you measure with /tool profile under real load.
Read on: QoS and bandwidth, Bridge and ports and Checks about speed.