Sorry guys for late response - I didn't get any e-mail notification for that topic
So. We know how your connection should be. And how it is in real? What measurement have you did?
It's close to what ISP declares (at least...). I measured it using standard speedtest.net + test to my own servers in various locations.
What do you see in torch?
Nothing special - just upload/download sessions and usual DNS traffic.
Aren't you participating to the dns ddos attack?
Absolutely not - by default all of my routers are configured to reject all unknown inbound traffic
You can prioritise the traffic to let http go faster without drops.
After digging I did something which is ekhem... maybe close to proper prioritetization:
/queue tree
add max-limit=2M name=QoS_WAN_Up parent=ether1-wan
add name=QoS_1 packet-mark=QoS_1_Up parent=QoS_WAN_Up priority=1
add name=QoS_2 packet-mark=QoS_2_Up parent=QoS_WAN_Up priority=2
add name=QoS_3 packet-mark=QoS_3_Up parent=QoS_WAN_Up priority=3
add name=QoS_7 packet-mark=QoS_7_Up parent=QoS_WAN_Up priority=7
add name=QoS_8 packet-mark=QoS_8_Up parent=QoS_WAN_Up
add name=QoS_4 packet-mark=QoS_4_Up parent=QoS_WAN_Up priority=4
/ip firewall mangle
add action=mark-packet chain=postrouting comment=QoS dst-port=80,443 new-packet-mark=QoS_1_Up \
out-interface=ether1-wan packet-size=0-1024 passthrough=no protocol=tcp tcp-flags=syn
add action=mark-packet chain=postrouting dst-port=80,443 new-packet-mark=QoS_1_Up out-interface=\
ether1-wan packet-size=0-1024 passthrough=no protocol=tcp tcp-flags=ack
add action=mark-packet chain=postrouting dst-port=53 new-packet-mark=QoS_1_Up out-interface=\
ether1-wan passthrough=no protocol=udp
add action=mark-packet chain=postrouting connection-bytes=0-1000000 dst-port=80,443 new-packet-mark=\
QoS_2_Up out-interface=ether1-wan passthrough=no protocol=tcp
add action=mark-packet chain=postrouting dst-port=110,995,143,993,25,20,21 new-packet-mark=QoS_2_Up \
out-interface=ether1-wan packet-size=0-1024 passthrough=no protocol=tcp tcp-flags=syn
add action=mark-packet chain=postrouting dst-port=110,995,143,993,25,20,21 new-packet-mark=QoS_2_Up \
out-interface=ether1-wan packet-size=0-1024 passthrough=no protocol=tcp tcp-flags=ack
add action=mark-packet chain=postrouting new-packet-mark=QoS_3_Up out-interface=ether1-wan \
packet-size=0-1024 passthrough=no protocol=tcp tcp-flags=syn
add action=mark-packet chain=postrouting new-packet-mark=QoS_3_Up out-interface=ether1-wan \
packet-size=0-1024 passthrough=no protocol=tcp tcp-flags=ack
add action=mark-packet chain=postrouting dst-port=110,995,143,993,25,20,21 new-packet-mark=QoS_4_Up \
out-interface=ether1-wan passthrough=no protocol=tcp
add action=mark-packet chain=postrouting connection-bytes=1000000-0 dst-port=80,443 new-packet-mark=\
QoS_4_Up out-interface=ether1-wan passthrough=no protocol=tcp
add action=mark-packet chain=postrouting new-packet-mark=QoS_8_Up out-interface=ether1-wan protocol=\
tcp src-port=8730
add action=mark-packet chain=postrouting new-packet-mark=QoS_8_Up out-interface=ether1-wan p2p=\
all-p2p passthrough=no
add action=mark-packet chain=postrouting new-packet-mark=QoS_7_Up out-interface=ether1-wan \
passthrough=no
It only lacks priorities for IKE & IPSec.
Using following tree is somewhat stable, but all suggestions are welcome.