I have massage in my log with this critical error:
login failure for user admin via bandwidth-test

How can I see the IP address who make experiments?
I have only open winbox service!

Bandwidth test server is hidden! It isn't listed under services but under tools / btest server. If people are able to try to log into it though, this suggests your firewall configuration is incomplete.

My question is : How can i see the IP address from where experiments are being done?
Can I see it or not?