#内网地址段改为自己的
/ip firewall address-list add address=192.168.1.0/24 disabled=no list=lan
/ip firewall mangle add action=add-src-to-address-list address-list=Online address-list-timeout=1m chain=prerouting comment=tongji disabled=no src-address-list=lan

/system scheduler
add comment=tongji disabled=no interval=3m name="\CD\B3\BC\C6" on-event="#\D7\EE\B4\F3\D1\AD\BB\B7\B4\CE\CA\FD\r\
    \n:global rmaxlimit 5000\r\
    \n:global r 0\r\
    \n:global rn\r\
    \n:global rs\r\
    \n:global ravg\r\
    \n:global rmax\r\
    \n:if ([:len \$ravg] = 0) do={\r\
    \n:set ravg 0\r\
    \n:global rn 0\r\
    \n:global rs 0\r\
    \n:global rmax 0}\r\
    \n:if (\$rs = \$rmaxlimit) do={\r\
    \n:global rn \$ravg\r\
    \n:global rs 1}\r\
    \n:foreach b in=[/ip firewall add find list=\"Online\"] do={:set r (\$r+1)}\r\
    \n:if (\$rmax < \$r) do={:set rmax \$r}\r\
    \n:set rs (\$rs+1)\r\
    \n:set rn (\$rn+\$r)\r\
    \n:global ravg (\$rn / \$rs)\r\
    \n:log warning (\"\B5\B1\C7\B0\D4\DA\CF\DF\BF\CD\BB\A7\BB\FA\" . \$r . \"\CC\A8,\C6\BD\BE\F9\D4\DA\CF\DF\BF\CD\BB\A7\BB\FA\"\
    \_. \$ravg . \",\D7\EE\B8\DF\D4\DA\CF\DF\C0\FA\CA\B7\" . \$rmax . \"\CC\A8,\B5\B1\C7\B0\CD\B3\BC\C6\B4\CE\CA\FD\" . \$rs . \
    \"\A1\A3\")" policy=reboot,read,write,policy,test,password,sniff,sensitive start-date=jan/01/1970 start-time=00:00:00