So after years of using Wrt, it appears my router has been hacked by users from China maybe?
What made me start looking, is total loss of connection until reboot. Seem the router appears to be running out of memory, so I checked the logs and found the following, repeated over and over
Fri Oct 4 01:30:29 2019 daemon.warn dnsmasq: reducing DNS packet size for nameserver 2001:4860:4860::8844 to 1280
Fri Oct 4 01:30:31 2019 authpriv.info dropbear: Child connection from 188.8.131.52:32700
Fri Oct 4 01:30:37 2019 authpriv.info dropbear: Exit before auth: Exited normally
Fri Oct 4 01:31:00 2019 daemon.info odhcpd: Using a RA lifetime of 1800 seconds on br-lan
Fri Oct 4 01:31:05 2019 authpriv.info dropbear: Child connection from 184.108.40.206:24563
Fri Oct 4 01:31:08 2019 daemon.info odhcpd: Using a RA lifetime of 1800 seconds on br-lan
Fri Oct 4 01:31:14 2019 authpriv.info dropbear: Exit before auth: Exited normally
I though dropbear was not set to allow outside access by default, but was allowed. So I have since set dropbear to only be allowed from LAN, changed the root password, then reloaded 18.06.4 as a lark
After all this it still running through memory at a fast clip normally I have about 98MB available, now its about 23MB lower, how do I clean this mess up?