Couldn't find anything regarding this - what does happen when CPU is over limit (100%)? Is there a process priority? I do know that VoIP does not like it at all but what decisions are made in the router I don't know. Can somebody explain?

What causes the 100% CPU load? What Mikrotik device do you use, and in what environment?

The board will spend almost all CPU in kernel mode, routing packets. Some packets will be dropped, there is no priority possible since the physical interface cannot dequeue the traffic fast enough before any kind of QoS can take effect. It's usually very obvious when a board hits 100% as all DNS stops working and sites no longer load -, usermode services like DNS, Proxy, etc will all be CPU starved and stop responding.

What causes the 100% CPU load? What Mikrotik device do you use, and in what environment?

750UP. Looking at the profile tool, it is spending most of the cycles on the firewall (incl conn+packet marking) which also peaks really high together with networking, dns is up to 1-15%
Most of the time the CPU is ~20% but it peaks 100% briefly for a few times every working hour. Queuing doesn't take much at all to my surprise. Central office envrionment router on dual 20/20 links and 8 OVPN branch links.

For me it looks like I need a beefier model.

Remote DNS Traffic?

/ip firewall filter
add action=drop chain=input dst-port=53 in-interface=ether1-gateway protocol=udp
add action=drop chain=input dst-port=53 in-interface=ether1-gateway protocol=tcp

That is already taken care of.


Btw thank you R1CH for your input!