Why your ASUS gigabit router caps at 500 Mbps
(and the 8 settings that fix it)

Three things together identify this pattern almost perfectly:

1. The speed test that runs on the router itself — the one in your ISP's app, or speedtest.xfinity.com if you're on Xfinity — reads close to your plan speed.
2. Every device behind the router caps at roughly half that number, plus or minus.
3. The cap holds whether the device is on Wi-Fi or wired Ethernet, and across multiple devices.

If your router is in the ASUS RT-AX family — RT-AX55, RT-AX58U, RT-AX82U, RT-AX86U, RT-AX88U, RT-AX92U, and several others — this is the textbook signature. It typically isn't the cable. It isn't the ISP. The router CPU is forwarding every packet in software because hardware NAT acceleration got switched off.

ASUS routers in the RT-AX line are built on Broadcom SoCs that include dedicated silicon for moving packets between interfaces. The acceleration paths have a few names — CTF (Cut-Through Forwarding), Flow Cache, runner — but the concept is the same: when the router doesn't need to look at a packet, it shouldn't have to copy it through the CPU. It can hand it off in hardware. That hardware path is what lets a $200 home router move gigabit traffic without breaking a sweat.

The catch: any feature that wants to inspect packets forces the router to take the slow path. AsusWRT silently disables the hardware accelerator whenever you enable certain features, and most users have no idea that's the trade. Software forwarding on the BCM4908 (RT-AX86U) tops out around 400–700 Mbps depending on which features are running, which is why "capped at half my plan" is so consistent — it's the CPU's ceiling, not the line's.

The fix is mostly identifying which features you actually need versus which ones are silently costing you half your bandwidth. Eight features are the usual suspects.

Do the changes one at a time. Disable one feature, then run a speed test. Two reasons: you find out which feature actually cost you, and you don't break a security setting you didn't realize you needed.

1. Run a baseline. Use Cloudflare Speed Test or your ISP's official test, on a wired device, plugged directly into one of the router's LAN ports.
2. Disable the next feature on the checklist. Wait 30 seconds for the router to settle. Run the test again.
3. If throughput recovered, that feature was costing you bandwidth. Decide whether you actually need it back.
4. If throughput didn't change, re-enable the feature and move on. Don't leave defenses turned off you didn't need to disable.
5. When you're done, run the StabilityPulse stability test. The throughput recovery confirms you fixed the bandwidth cap; the stability test confirms you didn't introduce bufferbloat or jitter while disabling QoS.

Disabling AiProtection isn't free. Trend Micro's threat feed is actually pretty good at blocking known-bad domains, and the intrusion-prevention rules catch some classes of inbound attack. If you turn it all off and don't replace it with anything, you lose a real layer of defense.

The alternatives that don't bottleneck routing:

• DNS-level filtering. NextDNS or Quad9 at the router's DNS setting blocks malicious domains before the connection happens. Free, runs upstream, no CPU cost on your router.
• Pi-hole or AdGuard Home. If you're comfortable running a Raspberry Pi or container, you get more control over what's blocked and visibility into who's connecting where.
• Browser-level extensions. uBlock Origin catches most of the same threats AiProtection blocks at the network level, and doesn't cost you any router CPU.

Pick one. The point is that "I disabled AiProtection to recover throughput" doesn't have to mean "I'm running naked" — it means you've moved the defense to a layer that isn't competing with your bandwidth for CPU cycles.

If you've worked through all 8 features and you're still capped well below your line speed, the router itself has probably hit its hardware ceiling for your plan. The RT-AX86U is rated for gigabit and delivers that comfortably with acceleration engaged. It is not rated for 2 Gbps service, and no amount of feature disabling will get it there.

The honest upgrade paths:

• Same family, refreshed silicon: ASUS RT-AX86U Pro (affiliate). Same form factor, faster CPU, handles 2 Gbps with acceleration on.
• Wi-Fi 7 upgrade: ASUS RT-BE96U (affiliate). 10 GbE WAN, MLO, the works. Overkill for most homes but the right call if you're on 5 Gbps fiber.
• Mesh, with wired Ethernet backhaul: ASUS ZenWiFi BT (affiliate). If coverage is the actual issue and the throughput cap is secondary, a wired-backhauled mesh moves the problem.

Before you spend money, though: the plan calculator will tell you whether you even need the higher tier you're hitting the cap on. The number of households paying for 2 Gbps and capping at 500 Mbps because of router config — and who would be perfectly served by a downgrade to the 500 Mbps tier they're already getting — is non-trivial.

ASUS won't tell you that AiProtection halves your throughput. The product manager wants AiProtection enabled — it's a marketing feature, a recurring relationship with Trend Micro, and a checkbox in the box copy. The router engineering team knows about the acceleration cost; the documentation doesn't surface it.

That gap is the reason this article exists. If you found it useful, the StabilityPulse stability test is the next thing to run — once your throughput's back, the next question is whether the line is stable enough for calls.