## MikroTik AWR in action

**Sample prompts**:
- Generate a MikroTik AWR report
- Audit my router's security and performance using mk-awr
- Model Claude Sonnet 3.5

Here is an example of an Automatic Workload Repository (AWR) style report generated by the `mk-awr` tool for a MikroTik router, highlighting performance metrics and security risks:

### **Device Information**
- **Identity**: Core_Router_Edge
- **Model**: CCR2004-16G-2S+
- **RouterOS Version**: 7.12.1
- **Uptime**: 45w2d14:32:10

### **Performance Metrics**
- **CPU Load**: 12% ✅
- **Free Memory**: 3.2 GB / 4.0 GB ✅
- **Disk Usage**: 128.5 MB / 512.0 MB ✅

### **Security Audit**

#### **Insecure Services** 🔴 **Critical Issue**
- **Insecure Services Enabled**: telnet, ftp, www
- **Issue**: These services transmit data (including credentials) in plain text.
- **Recommendation**: Disable these services and use `ssh` and `www-ssl` instead.

#### **DNS Open Resolver** ⚠️ **Warning**
- **Allow Remote Requests**: true
- **Issue**: If not properly firewalled, your router can be used in DNS amplification attacks.
- **Recommendation**: Ensure firewall rules drop incoming DNS requests (UDP/53) from the WAN interface.

#### **Neighbor Discovery** ⚠️ **Warning**
- **Neighbors Found**: 3 devices detected via CDP/LLDP/MNDP.
- **Issue**: Discovery protocols can reveal topology information to potential attackers if active on WAN interfaces.
- **Recommendation**: Restrict neighbor discovery to internal (trusted) interfaces only.

### **Network Summary**
- **Active Interfaces**: 5
- **Top Interfaces**:
  - `sfp-sfpplus1` (Gateway): Running, 10G
  - `ether1` (Local-Bridge): Running, 1G
- **IP Config**: 2 public IPs, 4 internal subnets.

### **Recommendations**

#### 🔴 **Critical Priority**

1. **Secure Access Methods**
   - **Action**: Disable insecure management services.
   ```routeros
   /ip/service disable telnet,ftp,www
   ```

2. **Firewall DNS Access**
   - **Action**: Add a rule to drop DNS requests from WAN.
   ```routeros
   /ip/firewall/filter add action=drop chain=input dst-port=53 in-interface=ether1 protocol=udp
   ```

#### 🟡 **Medium Priority**

3. **Neighbor Discovery Management**
   - **Action**: Set discovery interface list to 'none' or 'internal'.
   ```routeros
   /ip/neighbor/discovery-settings set discover-interface-list=internal
   ```

4. **Firmware Update**
   - **Note**: Version 7.12.1 is stable, but check for latest bugfix releases.

**Estimated Impact**:
- Significantly reduced attack surface for credential sniffing.
- Prevention of participation in DDoS (DNS amplification) attacks.
- Improved network obscurity by disabling discovery on public ports.