MikroTik

bratislav

CSS318-16G-2S+IN mains power input is nice but C14 plug would be even better because it is more common and easier to use with UPS for example...
On the other hand it would be really nice to have POE in port and DC power input, maybe something to consider for CRS318-16G-2S+IN...

bratislav

FastPath will allow for faster packet processing basically skipping entire bridge packet flow... if preconditions for FastPath allows it...
https://help.mikrotik.com/docs/spaces/R ... S-FastPath

bratislav

My experience so far is that wifi-qcom-ac is just not worth the trouble, it is way more unstable and there is no significant performance gain so if you don't absolutely need new CAPsMAN just stay with the older wireless package... I disagree. +1 on disagreeing. MAJOR difference in performance betwe...

bratislav

it seems that in versions 7.17beta/rc there is some kind of problem that is actively consumes space on a flash on my ac2, I successfully used 7.16rcX for several months without errors, but after updating to 7.17rc2, less than a day later, dozens of saving errors began to appear Did you check space ...

bratislav

Chateau PRO ax does look kind of shabby, cost cutting gone to far making it pretty much pointless... Especially with many products based on the ipq-8072a available on the market with 2.5Gbps ethernet (some with 5G cellular modem capability) and some, like very nice QNAP QHora-301W, even with 2x10Gbp...

bratislav

Would it not be better to present the QR code as an image? Then font does not matter. Not if you also want to display QR code in a terminal :) █▀▀▀▀▀█ ▄ █ █ █▀▀▀▀▀█ █ ███ █ ▀ ▀▀▄ █ ███ █ █ ▀▀▀ █ ███▀▀ █ ▀▀▀ █ ▀▀▀▀▀▀▀ █ ▀ ▀ ▀▀▀▀▀▀▀ ▀▀ █▄▄▀▀ ██▀ ███ ▀█▄ █▄▄▀▄█▀ ▄ ▀▄ ▄▀▄█▀▄█ ▀▀▀▄▄ █ ▀ ▀▀ ▄ █▀▀▀▀▀█ ▀ █...

bratislav

As a new web view , the wireguard peer QRcode is still like this: 截图 2024-11-12 14-56-01.png That is most likely a font (or encoding) issue... you may try and copy the text (QR code is actually a text) and paste it into Notepad and set the font to Consolas, regular and script to western... wireguar...

bratislav

Eventually, it seems that in these 2 HAPAX2 that the problem occurred, i had not set admin MAC address like the other devices. I do not know what does it mean but i set them. Hope that helps me. Until now the static IP survives the reboot. You should always set admin MAC address on the bridge (best...

bratislav

I'm afraid this is not fixed yet. cAP AC, reboot after 2d22h due to kernel failure. PRTG monitoring shows increasing memory usage until reboot happens. Back to daily scheduled reboot for now 8) I already have an open ticket, will send autosupout there. Not good news.... I use 44 piece cap AC with q...

bratislav

Sorry guys, but 802.11be was standartized already - 26.9.2024. https://standards.ieee.org/ieee/802.11be/7516/ It is a preliminary version as can be seen from the title: IEEE 802.11be-2024 IEEE Approved Draft Standard for Information technology Although no changes are expected in the final version...

bratislav

It is quite sad, that we are happy, that Mikrotik published AX device. Competition released many WIFI 7 devices - Ubiquity, TP-link, Zyxel..... Maybe Mikrotik is only one, that is releasing AX device. Wi-Fi 7 or 802.11be final ratification is not expected until the end of 2024, although many device...

bratislav

Definitely not SoC limit. See https://wikidevi.wi-cat.ru/Qualcomm and 160 MHz bandwidth with 6E band should be supported too according Qualcomm. https://www.qualcomm.com/products/internet-of-things/networking/wi-fi-networks/networking-pro-series/qualcomm-networking-pro-610-platform I think the Qual...

bratislav

New hEX looks great. We have been using old one as an edge router in many cases, it has pretty decent performance up to 500Mbps internet links and pretty good IPSec performance, and now with much faster CPU cores it should do much better even with more queues and firewall filters as suggested on tes...

bratislav

Please, pretty please :-).... I really need some wsap hw UPDATE !!! I would really appreciate some device hw update, ideally with the same form factor (wsap) but with AX wireless and (at least ) 1Gbps eth ports. As you can be seen on this new wAP ax chipsets require pretty large heatsink, not somet...

bratislav

@bratislav: interface/ethernet/monitor numbers=0 duration=1 name: ether1 status: link-ok auto-negotiation: done rate: 2.5Gbps full-duplex: yes tx-flow-control: no rx-flow-control: no supported: 10M-baseT-half,10M-baseT-full,100M-baseT-half, 100M-baseT-full,1G-baseT-half,1G-baseT-full, 2.5G-baseT ad...

bratislav

There is still a bag in MSTI status data, if we change MSTP bridge priority from 0x7000 to 0x6000 for example: interface/bridge/print proplist=name,protocol-mode,priority Flags: X - disabled, R - running 0 R name="bridge" protocol-mode=mstp priority=0x6000 MSTI status data for dynamic inst...

bratislav

on the "link partner advertising" section I can't see 2,5Gbps. Shouldn't appear there?. On my RB5009 ether1 is connected to a 2.5GbE switch and it also doesn't show the 2.5G rate under Link Partner Advertising. But the negotiated rate is still 2.5Gbps and there is no problem reaching that...

bratislav

container and run whatever you like. I usually do run DNS servers on a dedicated VMs and not on RouterOS, but wouldn't it be simpler for all, both Mikrotik and us users, that instead of wasting decades on trying to make proprietary software for something as common as DNS, and fail, you use somethin...

bratislav

so we're far from a "real" DNS server. And, I'm sure others have their own DNS grips. MikroTik should offer "unbound" as an optional DNS resolver package (that replaces the internal one when installed), much like in v6 you could install an optional NTP client/server that would r...

bratislav

Even wifi7 ceiling APs from other vendors are smaller in diameter than CAP AX. When other vendors smallest devices are 220mm - how huge will Mikrotik go? 300mm CAP BE? I am sure Mikrotik could easily make something smaller, hAP ax2 is much smaller than cAP ax for example and it has 5 ethernet ports...

bratislav

Odd-numbered releases could focus on introducing new features, even if they might bring heavy breaking changes. This requires extensive testing and broad customer feedback. Even-numbered releases could prioritize stability and refinements, addressing feature reliability and minimizing impact. This ...

bratislav

Is there a list of supported SFP modules and has it been updated? I presume you could have find this yourself, the link is listed in all devices specs that have SFP interfaces: https://help.mikrotik.com/docs/display/ROS/MikroTik+wired+interface+compatibility And it is updated from time to time... U...

bratislav

it seems v7.16 is dumping random MACs (multicast?) in the same hosts table as regular ones - i even turned IGMP Snooping off and it keeps doing this.

Multicast MACs should start with 01:xx ... would be interesting if you sorted host list in ascending MAC address order...

bratislav

SFP+ DAC cables produce no heat at all, fiber SFP+ modules usually aren't very hot either. It would be nice to have additional SFP+ even with the restriction, no support for copper modules because of power/cooling constraints. Users often use copper SFP+ (S+RJ10) modules in passively cooled devices...

bratislav

In the CRS305 that port is connected to the switch chip. In the CRS304 it's connected to the CPU.

Similar to CRS312-4C+8XG-RM which is therefore not called CRS313...

bratislav

Hi, CRS304 switching results are they correct? https://i.imgur.com/GYIrS84.png Regards, It seems they are missing a zero there (it should be at least 20000Mbps although block diagram suggests wirespeed switch and should give 40Gbps throughput and 80Gbps capacity), otherwise old RB260GS gigabit swit...

bratislav

".home.arpa" DNS queries are still being leaked to the WAN network and is not conform to rfc8375. Can it be fixed ASAP please? That is only a "proposed standard", one of several that were made with the same objective. When you want to use that domain and don't want to leak it yo...

bratislav

*) wifi-qcom-ac - improved memory allocating process;

Upgraded a single hAP ac2 so far to check if (hopefully) OOM reboots are really fixed with this one...

bratislav

I won't answer your questions directly, but rather advise you to check out nokia eda, get in touch with those guys and make routeros compatible with that system. Why reinvent the wheel when there are some good ones already rolling? Make your cart use them :) ps. let's not have another ubnt, mikroti...

bratislav

I am dubious about "many" saying it "is OK!".

Maybe we should have a poll on the subject... that way we should know definitively...

bratislav

... on 1 cap AC using wifi-qcom-ac driver... Oddly enough, no such issue on ac2 with exact same config (same RAM amount so why ??). hAP ac2 has 3 more ethernet ports, so more buffer on switch chip is in use ... perhaps that's a life saver? LOL cAP ac and hAP ac are using exactly the same SOC IPQ-40...

bratislav

Would be really nice if we also get genuine mac-telnet text mode application from Mikrotik... That does exist, though it is open source and not from Mikrotik: https://github.com/haakonnessjoen/MAC-Telnet I know that couple of versions including this one exists, but they rely on reversed engineered ...

bratislav

Would be really nice if we also get genuine mac-telnet text mode application from Mikrotik...

bratislav

@bratislav, interesting, as I have the same setup, including 2 DACs in 802.3ad bond for peer link with dedicated PVID. All VLANs are tagged on the LAG-PeerLink except for the PVID (3999) for the peerlink, which is untagged on LAG-PeerLink. Multiple LACP bonds to fabric switches (some MT some not), ...

bratislav

The issue is not ESX, that is just a highly visible victim. The floor switch (crs328p) connected lacp across both crs317 (mlag) switches also loses the ability to ping one of the mlag switches for a period of time 5-15mins after the switch has actually finished rebooting. It seems like the mlag is ...

bratislav

Maybe things would be better when ESXi would support a port aggregation protocol like LACP, but it does not.
(at least not without buying extra products)

vSphere supports LACP on distributed switches which are available with Enterprise license and not as a separate extra product...

bratislav

Not really true, since we apply lots and lots of patches Not using a LTS kernel can't be "patched" by applying "lots of" patches. Your kernel branch is not supported anymore. It is kernel version 5.6.3 apparently. You may backport and apply all the patches you think you need sel...

bratislav

leaving only a about 250kB free space You have at least 650-700kb free space on 7.15.x with wifi-qcom-ac package. You may both be right as the configuration can take hundreds of kilobytes of flash, so the difference is easily explainable this way. I've learned that the hard way, losing about three ...

bratislav

Auto-mac=on will pick any available mac-address of your device. If you set admin-mac without setting auto-mac=no that configuration doesn't make any sense and therefore admin-mac would not be saved at all and auto-mac would be in effect: interface/bridge/add name=bridge-test admin-mac=9A:3C:61:97:0...

bratislav

@prawira why did you open a support ticket? feature request or what was your intention? the case is on client side installation . it was running fine on 6.49.10 and got problem as soon as upgrade to 7.15.2 i spend hours to find out that it's really wifi-qcom-ac problem and it works fine as soon as ...

bratislav

To me it sounds really broken if you are forced to use netinstall (to completely wipe the storage) for every upgrade. If it's possible that configuration changes get (due to bugs) out of sync, then it's possible to see the command you wrote to fail to do everything properly as well. Netinstall is s...

bratislav

How exactly did you move between ROS versions?

I reinstalled on clean config and entered it back manually...

bratislav

I wonder if anybody else tested the speed of ROS 7, and 7.15.2 in particular, compared to ROS 6 (say 6.49.13)? I suspected for some time that ROS v7 is much slower than v6 and decided to check this on my rb3011 . And lo and behold on the same 1Gbps internet link with same configuration, same and pre...

bratislav

There is a bug in a new and useful MSTP feature (introduced in 7.14 i believe) and that is that now MSTI shows ID 0 MSTI as dynamic entry... The issue is that if you change something for MSTI 0, priority for example, it doesn't change until you reboot the switch: interface/bridge/print proplist=prio...

bratislav

I would say it is a bug in Hetzner VM installation procedure, on x86 it automatically extends file system for given image to full HDD size, on ARM is does not so you have to do it manually...

bratislav

We have 2 VM's and both with 40GB disks. On x86 CHR show 37.9GiB, on arm64 CHR show 9.0GiB - shouldn't they show same value in both cases? Maybe this is something you should discuss with Hetzner, after all it is their virtual platform... On the other hand do you really need more than 9GB for CHR?

bratislav

USE
WiFi Security -> FT(TAB) --> FT Enabled = YES
Should fix that for you
Enabled day one.

Actually you shouldn't enable FT unless using CAPsMAN and multiple APs...

bratislav

Moved from 7.15rc2 to 7.15rc4 and after a few days, DNS completely stopped working . - Tried flushing DNS(Mikrotik Cache) - did not help. - Removed my local DNS(PiHole + unbound) and switched to 1.1.1.1 + 1.1.1.2 - did not help. - Restarted a bunch of times and tried to set ISP IP as DNS - did not ...

bratislav

Why use a static setting with such a wide variety of devices ? Make it dynamic based on RAM or a setting. I explained already: it is a compile-time setting for the Linux kernel. No it isn't actually... in Linux maximum number of net.netfilter connections is controlled by these two parameters and is...

bratislav

yes, imagine..what would do very high wind to this stick... fanny

Basically the same thing as it would do to your car antenna, you should try and understand that larger antennas give more resistance to air flow and are therefore more likely to fly away...

bratislav

ROS does no HPKP as far as I know. It's something a client should do. As for any connections made by ROS itself: ROS does not ship with certificate bundles. You need to import the ones you trust anyways. So it does not get more secure. HPKP is obsoleted and deprecated for years and removed from mos...

bratislav

The anntenas with the NetMetal AX. Im looking for small omnidirectional and small directional anntenas.

You mean small outdoor omnidirectional antennas like the HGO-antenna-OUT literally offered with NetMetal ax...

bratislav

"My CPU usage is high" could honestly be anything.

That is correct of course, but high CPU usage caused by BGP under certain circumstances as reported by rpingar is a bit more to the point :)

bratislav

Would be nice and useful IMHO if Mikrotik makes some kind of searchable bug trucking site as most Linux distros do, that would allow users to check if issue they are experiencing has already been reported and accepted for a fix (hopefully avoiding many duplicate reports that can bog down people in s...

bratislav

They use netinstall-cli 7.16alpha50 in this public video: https://www.youtube.com/watch?v=EdwcHcWQju0 That is installation utility that runs on generic Linux OS and is developed independently of RouterOS, although yes version 7.16alpha is probably improved so that it can install some initial Router...

bratislav

I wonder why ROS gives us the ability to profile CPU usage - but no tools to just see the RAM usage in a similar way. This makes no sense as they could "anonymize" processes similarly as they do in CPU-profiling. If such a RAM profile feature would exist, we as the users could at least ge...

bratislav

Arm based devices must use v7, there is no option for them. Others can be downgraded v6 no matter what os they have afaik. For abandoned os last few versions pointless for me. That is not true, most 32bit ARM devices used to come with v6 and can run it still, although few have the hardware upgraded...

bratislav

I'm not so sure about that. E.g. on other manufacturer's equipment, one chain can remain operational while the other scans or surveys the band, monitors neighboring APs, etc. That is not correct. Regulations direct that after initial Channel Availability Check (that can last anywhere from 1 min up ...

bratislav

You are taking words from the context. If you have taken the time and read my first comment you could see that I have given a lot of information. If someone from support would comment on it I would gladly export my configuration or anything else that is necessary to solve it. Again: support does no...

bratislav

Looks like developers have a crazy view on this. I am very involved in linux package management, and a version being unambiguous causes nothing but troubles. Versions must be unique! What happens if you download the version from mikrotik.com/download ? Is it " stable " or " long-term...

bratislav

Our SSH is not based on 3rd party implementation.

And more importantly in this particular case RouterOS doesn't use systemd as far I can tell, but does use xz (where malware is actually distributed) for npk archives so maybe you should check if what you are using is affected version...

bratislav

I'm guessing ROSSH it's based on Dropbear

Strictly speaking the attack is against systemd which is dependent on liblzma, regular upstream openssh (unpatched for systemd notify functionality) is not affected...

bratislav

Well I hope everyone was inspired and did a double check on all Firewall rules, to make sure nothing can access the router from any untrusted network. If no packet can reach the router, even yet undiscovered vulnerabilities won't bother you. Unless malware connects to CC server which then takes con...

bratislav

Why not remove, for example, Mesh from the ROS for ARM? Surely it will be possible to gain a little in the size of the image. Mesh is relatively small at around 75k, that is roughly half the size of pretty useless cloud and wproxy and only third of totally useless lcdstat since only RB3011 actually...

bratislav

Hi again, related to my previous post, I found following statement in documentation: fan-min-speed-percent: [...] *NOTE: the default value may vary based on FAN controller chip and/or specific model requirements. From RouterOS verson 7.14 default value is set to 12, all previous versions have 0. [....

bratislav

If you are putting fans in the unit, why on earth why not design the whole switch then for a front-to-back or side-to-side airflow. If you are putting this device is a warm closet, the powersupplies and SFPs might be OK, but the chips will run very hot since the airflow doesn't pass the heatsink. A...

bratislav

It is always a good practice to refresh the page to avoid these kind of errors...

bratislav

It's also very strange to have both fans and a big passive radiator. It's neither forced-air cooled nor passive-cooled. It must be quite expensive to manufacture all that heatsink for nothing. Forced air devices have the advantage of be able to operate in warmer areas, passive ones can not. Forced ...

bratislav

Also, why is it using a mipsbe CPU when MikroTik is clearly moving everything they have to ARM? Even the $60 hAP ax lite has a dual core ARM CPU, but a $1000 switch does not? As far as I can tell they use the same CPU (QCA9531) on their top of the line CRS5xx 100Gbps switches, and on a side note it...

bratislav

I understand what you say but I don't understand why that would be needed... doesn't make sense from a practical point of view. Auto MDX is something from the previous century ! Anyhow, SUP-146041 created. Let's see what support says about it. Actually I believe onnoossendrijver is correct, modern ...

bratislav

Follow up: On CSS610 I set an S+RJ10 to forced 2.5Gb, connected to ether1 of AX3 using VLAN trunk. Link becomes active. So far so good. On AX3 log files I see it determines speed as being 2.5Gb, which is ok however ...nothing passes (after the facts I can see in log files what happened). Only when ...

bratislav

With some obvious storage space issues and rose storage with btrfs and nfs kernel modules being a separate package, as it should be IMHO, I wonder why other pretty large file system kernel modules such as cifs, smb3, ntfs3 had to be added in the base routeros bundle making install next to impossible...

bratislav

What causes this message regarding a backup-routerboot upgrade? Screenshot from 2024-02-29 09-48-58.png

edit: Device is RB960PGS (hEX PoE) r2.

Have you bothered to actually read the page from the link provided?
https://wiki.mikrotik.com/wiki/Manual:R ... bootloader

bratislav

I was able to recreate the issue by just adding the management vlan, that is if I try the upgrade from vlan tagged network it will fail... Did you have the management interface to be accessible ONLY from VLAN99 ? (that is what I had on my CSS106-5G-1S switches) It was VLAN 40 in my case and I didn'...

bratislav

these switches are pretty "standard" as the all have vlan99 added for maintenance and access to the switch only from vlan99. RSTP disabled and all ports allowing all vlans ... Not to special - created backup - reset to default switch came back on a dhcp in the generic vlan - upgrade - res...

bratislav

tried resetting the switch to default and then update? Just tried that, that works. But not really an option for remote switches. I got this one to the lab because it did not succeed, there is a spare on the actual location now ... Have a couple of others remote .. I upgraded dozens of switches, CS...

bratislav

Upgraded from 7.13 stable to 7.14RC4, started having kernel panics. Downgraded to 7.13.5 stable and still having the kernel panics (full system reboot, log not displaying anything except for that a power supply interruption might've happened). RB5009UPr. Are you sure that it isn't actually a power ...

bratislav

If capsman wasn't enabled, there is 0.0 reason for having that wireless package installed. My take: Don't install it by default on a switch. If needed, device's admin can always add wireless him/herself. But at that point I suspect it's an admin knowing what he/she is doing. Packages are upgraded b...

bratislav

I'm not 100% sure it's related to this release but I haven't seen this in any earlier ones and I had all of 7.13.0-7.13.3 before. Hardware: hAP ac2 with 7.13.4 and wifi-qcom-ac configured as CAP with some vlan extras. Since 7.13.4 the vlan bridge is changing its MAC address multiple times. After th...

bratislav

cAP XL ac and wAP ac upgraded (from 7.13.4) without problems (besides my RB4011).
Only had to suppress Wireguard logging.

I presume wAP ac is an arm version not mipsbe...
Was the wifi-qcom-ac package used?
How much HDD space was left free on cAP XL ac and wAP ac after the upgrade?

bratislav

Not only they're not unbundling optional packages like PPP and Routing, but they also added Rose (SMB) functionality to the main package. IMO smb functionality is also optional and shouldn't be included in the main bundle. Rose is much more than just SMB (it contains nfs, btrfs ...) and is external...

bratislav

I don't believe that routing protocols significantly increase the size of the main package or are easy to separate. The biggest impact comes from binary files. There are some with significant size and not everybody needs. dot1x (100k), lcdstat (212k), quickset (136k), smb (168k in 7.13.3), upnp (10...

bratislav

Also, Chateau 5G R16 - 16MB storage ? Seriously ? In 2024. ? And it is RouterOS v7 only... Maybe it is a good thing, this will insure that MikroTik commits extra effort to make new versions of RouterOS v7 fit on 16MB unlike recent Betas... But I am not sure if it wouldn't be cheaper and better in t...

bratislav

That is what I mean! E.g. "unbound" provides everything the RouterOS resolver can do now, plus additional things that are still on the list of things-to-do, like DNSSEC support. I'm sure once work is done on that, all the bugs come back to haunt them. There are many good dns resolver opti...

bratislav

Indeed, they are in denial. We can only hope that 7.12.1 will be labeled long-term and maintained with security fixes...

Or one could go back to RouterOS v6 long-term, it is still supported and will be for some time as far as I can tell...

bratislav

I believe we all use sessions even unintentionally because by default WinBox will save current session for particular connection and restore the layout on next connection... Maybe it would be a good idea to be able to save "connectionless" session with some proffered windows layout not bou...

bratislav

... Is this memory usage okay for the wifi-qcom-ac package?.. free-memory: 33.2MiB total-memory: 128.0MiB With wifi-qcom-ac mine lightly used cAP ac now has: free-memory: 28.1MiB total-memory: 128.0MiB Which is roughly half of free memory (used to be around 54MiB free) when used with legacy drivers...

bratislav

2) if I want to use the new wifi menu & features, does it support A) No 2.4 GHz band at all (all 2.4 GHz is legacy on the old wireless menu) B) 2.4 GHz band only on specific devices (new AX routers?) with all other devices having no support for 2.4 GHz C) 2.4 GHz on all devices, but always usin...

bratislav

*) wifiwave2 - added station-bridge interface mode;

I presume this is incompatible with regular "wireless" package station-bridge and all APs not able to run wifiwave2 right?

bratislav

On hAP ax^2 (with wifiwave2) if you turn on Hardware Offload on ethernet ports (and it actually works meaning you have H flag) in a Bridge where wifi interfaces are connected (say LAN) the packets from wifi interfaces are not forwarded, it just doesn't work... I am not sure if this is the case in pr...

bratislav

To downgrade my RB941 to v6, I followed the advices at https://help.mikrotik.com/docs/display/RKB/Downgrading+RouterOS - downloading routeros-smips-6.49.10.npk (latest v6 Firmware) - uploading it via winbox to the router - issuing /system/package/downgrade at console It didn't come to /system/reboo...

bratislav

Endpoint-Independent NAT all world call it Full Cone NAT Actually Cisco calls it Restricted Cone NAT, but for example Juniper, Fortinet and many BSD variants call it Endpoint Independent mapping NAT... Here is one explanation that describes it pretty well... https://docs.netgate.com/tnsr/en/latest/...

bratislav

Without 5&6 GHz? In y. 2023? Why bother at all? Sorry Mikrotik, but I see no use for this. A lot of people asking about the wireless part. This device is a drop-in replacement for our wildly popular RB2011 2GHz AP. It is still (yes, today) one of our best selling devices. There are plenty of us...

bratislav

Nice to see ax, I was forced to go with Grandstream for the last year or so just because some customers required ax... Although this is more home device and features like SFP etc just do not apply there... What I would like to see next is CAP ax but with one input and other output PoE and preferably...

bratislav

Yes, stays at 5-6% total CPU load with one core always at 100%.

Maybe check if ip/dns has allow-remote-requests=yes...

bratislav

At the moment we do not want to stick to a specific implementation or standard, but build our own that will help to manage, develop and deploy different scale networks running MikroTik devices. Maybe it would be wiser to drop a bit of vanity and instead of inventing everything from the scratch base...

bratislav

can you explain what is pref-src=0.0.0.0 what thats for?

If you have more than one IP addresses you can set the one that is used by default for this particular route...

bratislav

So, If we want to have the updated stable version, we can't run Dude.
Dude will work for 3 months and after will be dead for 3 months .

Unless you read the posts above to find out where the dude package is and upgrade it you wont be able to run it...

bratislav

Then probably will wait for 6.49.7 ...

I wonder what for?

bratislav

After upgrading RB760iGS (hEX S) from 6.49.6 to 7.2.1 sfp information is no longer visible with Mikrotik or OEM modules, although sfp seems to work.
The other problem is that if Hardware Offload is active on any port in the bridge with RSTP turned on the bridge stops forwarding packets...

bratislav

I wonder how useful 5Ghz backup connection would be over 2.4km link...

bratislav

maybe they'd commit some resources to a full winbox rewrite but right now it'd be a waste of time and money. This rewrite is overdue for over 10 years. It did not happen until now - so it wont ever happen. I don't recall MikroTik promised anything or any time frame and for most users the Windows ve...

bratislav

6.48.6 broke all PPP only for me? Сyclic PPP reconnections (client or server - it doesn't matter).
downgrade to 6.48.5 - fixed problem

And by all PPP you mean L2TP, SSTP, OVPN, PPTP, PPPoE or actually PPP that runs over serial connection?

bratislav

Although it may not be the usual subject for a new firmware release since this particular release is obviously plagued with some outstanding bugs we may state our opinion on what should be called a long-therm release... Since we already have stable and long-term branches in addition to testing and d...

bratislav

Would be nice if two RB5009 could be mounted in a half (10") RACK ...

bratislav

For any kind of funky setups, surely you need the normal MikroTik app, where a lot more options are available. This is for home users with no configuration needs. Those users mostly never change the password that is set initially so, although it may look like a nice touch, it seems like a bit of wa...

bratislav

I wonder if it would be too hard to check if package upgrade even works on supported platforms because it obviously doesn't on SMIPS using any standard procedure... On others you go without problems. I wonder why you write if you wonder? I wonder why you wonder if me or someone wonders why it is no...

bratislav

Mikrotik Staff, now you have the EXACT procedure for replicate the problem. https://forum.mikrotik.com/viewtopic.php?f=21&t=175735#p860864 I wonder if it would be too hard to check if package upgrade even works on supported platforms because it obviously doesn't on SMIPS using any standard proc...

bratislav

As for the hAP ac³ - it is almost 2x the size of the previous model. Pity there is still only 5 eth ports. Well, one is going to be used for the Internet connection, so actually 4 ports ... I use it for my home and my friend wants to redo his home network too, but needs more power. Will be deciding...

bratislav

It would be really nice if for smaller devices like this CSS610-8G-2S+IN switch MikroTik bundles second ear for 10" racks mount that are increasingly popular ... And also (as a separate item) a kit that will make possible to mount two units in one 19" space. May be but on the other hand i...

bratislav

It would be really nice if for smaller devices like this CSS610-8G-2S+IN switch MikroTik bundles second ear for 10" racks mount that are increasingly popular ...

bratislav

On the version 6.47.4 command repartition (e.g. "/partitions repartition partitions =2") causes the router's cyclic reboot (about every 10 seconds). On versions 6.47.x situation the same. Reset didn't help, I've been able to repare it only with netinstall On the version 6.46.7 this comman...

bratislav

Also what is the process for 'upgrading' a routerboard that does not have direct internet access from stable to long-term release channel when it is on e.g. 6.47.x? I give it the .npk from long-term, and even set channel to long-term in packages but log says that newer version is installed - seems ...

bratislav

IMHO You shold fix WinBox not ROS ASAP as upgrade to ROS > 6.47 is not always possible And remove Winbox 3.25 from downloads and upgrade ASAP. After struggling for some time with firewall order issue and now with all this wireless killer bugs I am reverting back to winbox64-3.21 that seems to work ...

bratislav

What's new in v3.25: *) added support for CTRL+ and CTRL- keyboard shortcuts for Zoom in and Zoom out; CTRL+ and CTRL- keyboard shortcuts for Zoom in and Zoom out work in Firefox, Chrome, Adobe products. Not in this release of WinBox. I thought you are confusing Webfig and WinBox until you mentione...

bratislav

OpenVPN realization in Mikrotik is still useless due to lack of SHA256/SHA512 support (SHA-1 deprecated https://shattered.io/ ) When SHA512 will be supported in Mikrotik? There is a difference between hashing (as SHA1) and encryption (as AES...) and just because someone is able to generate 2 differ...

bratislav

Many people in poor countries use hAP lite. They usually do not have the ability to buy better equipment. Features like IPsec and hotspot are essential for them. All you have to do is back up your settings before upgrading and reset the router to default configuration, then upgrade router and then ...

bratislav

I have a hap ac which was running on 6.47.1. I upgraded to 6.47.2 and it went well, then on reboot I upgraded the firmware too. But on reboot I couldn't login using winbox. The system was not responding to reset for 4 attempts. On the fifth time it got reset and I could login using winbox. What did...

bratislav

Actually there is much simpler explanation ... those RBs don't need more ... What about partitioning? :) Partioning? We don't need no stinkin' partitioning :D Frankly I find partitioning too much hassle to use on local devices, backups are just fine ... And RBs dont need partitioning, you do so cho...

bratislav

is it REALLY worth it!???? Yes it is. Lets call it planned obsolescence and whats the first rule of planned obsolescence? We don't talk about it! Actually there is much simpler explanation ... those RBs don't need more ... Firstly flash is not used to store firmware upgrade files, RAM is, as can be...

bratislav

Hi i dont believe that i will be able to upgrade my hex3. Only 4.9MiB free but nothing on the flash. Anybody an idea ? Im about 50km away from this box. I would downgrade to an older, much smaller version then upgrade to latest, but in your case that may give problem if you loose some function so t...

bratislav

the latest Linux Kernel 5.6.3 featuring new up-to-date Actually latest is 5.7.6, and latest 5.6 is 5.6.19 which is EOL by the way ... so I wonder why not 5.4 which is longterm maintenance release and will be supported to 2025 unless WireGuard is planned which was introduced in 5.6 (although WireGua...

bratislav

Can't upgrade one of my hAP lite from 6.44 to 6.44.1 -- "not enough space for upgrade" :( Files are empty, all modules are disabled ( system is active only), 14.3MB free RAM. But how much HDD space is free? That's what's used for upgrade in hAP Lite. Also, disabling packages does not free...

bratislav

This is my first version running a new bridge, don't know if it's a known bug. RB951G-2HnD running as just a Switch/AP (all ethernet+wlan ports under one switch/bridge, no vlans, no nat). If I change the mac address of an ethernet port while it's a member of a switch/bridge, most of the OS will han...

bratislav

That would be nice but unfortunately RBx00x devices are just too big to be mounted side by side in a 19" rack RB2011iL Dimensions Desktop:230x90x25mm Rackmount:443x92x44mm rb2011rack.png Have MikroTik ever had a discussion about the format of rackmounts. So to be able to mount TWO instead of on...

bratislav

Seems that new workaround option:

*) wireless - added option to disable PMKID for WPA2;

Does not prevent users to connect and so far everything works well for us ...

bratislav

And what about working on WPA3?

According to Qualcomm you need new chipsets for WPA3 so it seems that old gear wont be able to support it ...

bratislav

I checked this on all our routers upgraded to 6.42 or 6.41 ... And In ROS 6.41 and 6.42 Mikrotik Neighbor Discovery protocol outgoing traffic is actually allowed to bypass firewall altogether and cannot be caught in any chain, not something that any process should be IMHO ... And for me this is actu...

bratislav

Not related to Winbox security issue, but seems like a bug ... On 6.41.x and 6.42.x MNDP trafic is not visible anymore in firewall output chain ... For example I am using this rules /ip firewall raw> print Flags: X - disabled, I - invalid, D - dynamic 0 chain=output action=passthrough log=yes log-pr...

bratislav

Sadly, it looks like the footage was probably all from inside the Raging Wire data center and not an AWS data center. It was still good to see it being used though. Ragingwire is part of NTT, they are data center operator and they are in business of leasing data center space and infrastructure to c...

bratislav

Sadly, it looks like the footage was probably all from inside the Raging Wire data center and not an AWS data center. It was still good to see it being used though. Ragingwire is part of NTT, they are data center operator and they are in business of leasing data center space and infrastructure to c...

bratislav

It surely works in winbox.
Maybe on your routerboard. On rb922 (and others) don´t work

Interesting ... What versions of WinBox/Windows are you using?

bratislav

Also just to be clear on MikroTik APs mitigation is not yet available and the only option is to patch the clients and that maybe impossible especially with Android devices that probably will never receive a patch, so maybe a suggestion for MikroTik to develop something like this and make it availab...

bratislav

To summarize, the client does connect to the fake AP. That's why the researcher enabled ip forwarding on his linux box. Actually there are AP's that will do this (mitigate the 4-way handshake problem). I'm not sure it will break anything with compatibility but we administer a ton of AP's and they a...

bratislav

Apparently AP can mitigate this by "bending" the standard 4-way handshake and instead of re-transmitting message 3... It does not re-transmit anything during attack. It's an attacker who replays the message 3 that was originally transmitted by the real AP. It does actually ... the attacke...

bratislav

The demo from the researcher clearly indicates a man-in-the-middle attack. It is shown in the video on his website around 1:54 https://youtu.be/Oh4WURZoR98 Hence, the client does connect to the malicious AP. You seem to claim the client does not need to connect to the fake AP? You should have also ...

bratislav

You can fix the 4-way handshake issue either at the client side or at the Access Point side. ... So it's good practice to also fix it at the AP side:-). Wrong!!! KRACK is a pure client-side attack. Patching AP will give you nothing. Worse!!! Patching AP will just give some people false sense of sec...

bratislav

You can fix the 4-way handshake issue either at the client side or at the Access Point side. ... So it's good practice to also fix it at the AP side:-). Wrong!!! KRACK is a pure client-side attack. Patching AP will give you nothing. Worse!!! Patching AP will just give some people false sense of sec...

bratislav

Are you sure that you don't confusing "RB1100AHx4 Dude Edition" with one that is announced here "RB1100AHx4" Yes it is Dude Edition dude ... it is advertised here on top banner at $349.00 ... and that is way cheaper than what we have to pay here ... but enough of me whining :)

bratislav

I would really prefer if you did not announce the prices ... Local distributors here are selling Mikrotik gear way times more expensive, for example RB1100AHX4 is currently 570$ or 475$ before taxes, so it is pretty annoying to find out that we are being robbed like that, it is better just not to kn...

bratislav

Please plan some method to phase-out bundle package. (i.e. install separate packages from the factory, in some new version replace bundle package with the separate packages from the bundle) Why should Mikrotik do that? Packages are already available separately if you prefer it that way, but bundles...

bratislav

Thank you! I rebooted the router. Free memory 7.4 MB. I updated the firmware, all ok. You are welcome ... on the other hand this make me wonder ... Seems that hAP lite is very tight with RAM memory and that new upgrades can barely fit so problems like yours should be expected in the future ... Mayb...

bratislav

Hi all. I can not update the Mikrotik hAP lite firmware. Error: not enought disk space. It worked fine for me ... although I uploaded the npk file to router manually ... As far as I know files for upgrades are stored temporarily in RAM so there must be something hogging your memory ... You could us...

bratislav

Has anybody noticed this ... RouterOS 6.38.7 in WinBox does not show anything for encryption algorithm if using aes-gcm: gcmwbox.jpg Everything is actually working and command line shows encryption correctly: ip ipsec installed-sa print Flags: A - AH, E - ESP 0 E spi=0x0000000 src-address=1.2.3.4 ds...

bratislav

Make CHR to run on barebone switches. http://www.edge-core.com/productsInfo.p ... 143&id=264

It wouldn't be Cloud Hosted Router than and Mikrotik already has "barenone" hardware that is running RouterOS ...

bratislav

We are mostly VMware customers ... so for me some kind of VCenter integration, for example webfig access, would be really appreciated ...

bratislav

Maybe false alert, seems to be NOT related to 6.40.1. I had a chance to test with a friend's hEX. Worked reliably with 6.40, likewise with 6.40.1, both RouterBOOT 3.35. Thanks for the update ... I was too reluctant to go for 6.40.1 after your post ... now I may reconsider :) Anyways seems to me tha...

bratislav

Are you sure about RouterBOOT version? There is no such version at: https://wiki.mikrotik.com/wiki/RouterBOOT_changelog Also it seems to me that you have to update RouterBOOT separately by issuing system routerboard upgrade and then reboot ... Updated from 6.39.2 to 6.40.1 on a hEX (RouterBOOT 3.35 ...

bratislav

Absolutely agree ... and even the most powerful NGFW can not inspect SSL/TLS encrypted packets anyway (without meddling with Cert Store on each end user devices) ... I'm willing to bet that these virus scanning routers are only slightly better than worthless at actually providing real security from ...

bratislav

It does not work even if I put my vlan on ether1 or 2. It should be like this ... (if your vlans 20 and 30 are on ether2 ): /interface bridge add name=bridge1 add name=bridge2 add name=bridge3 /interface vlan add interface=ether2 name=vlan20 vlan-id=20 add interface=ether2 name=vlan30 vlan-id=30 /i...

bratislav

Shouldn't VLAN be created on Ethernet port, not the bridge ...
Or you are trying Bridge VLAN Filtering and vlan-ids ...

I'm creating VLAN20 on Bridge1 - there's still ok.
But when I add VLAN20 to Bridge2, RB is unavailable on these two ports.

bratislav

You got this wrong ... flash chips are declared in Megabits ... so the prices you found are for 4MB, 32MB and 128MB respectively ... I'm with you guys. I'm not sure what class embedded designers are taught to use tiniest flash chip available on the market but I'd like to alter that curriculum. That ...

bratislav

I really think Mikrotik should discuss using partitions in addition to backups.
Can I make partition(s) on my mAP Lite? It has only 32MB disk space.

Are you sure about that? mAP lite should have 64MB RAM and 16MB flash ... and no you cant use partitions ...

bratislav

100% CPU and can't connect How do you know that CPU is at 100% if you cant connect? And if you can somehow see this could you also check what is hogging CPU? Anyways it may be some DOS attack issue, my advice would be, if you have one spare port, to disconnect router from the network and plug only ...

bratislav

Upgrade went well on RB750GL but DNS has gone berserk check whether you're being used as an attack amplifier look whether /ip dns cache is filled with junk entries Actually you are right ... on that particular router i forgot to close input from internet ...and it was literally bombarded by million...

bratislav

Upgrade went well on RB750GL but DNS has gone berserk NAME CPU USAGE firewall-mgmt 3% ethernet 0.5% console 1% dns 82% firewall 2.5% networking 2% winbox 3% logging 0% management 6% routing 0% queuing 0% telnet 0% bridging 0% unclassified 0% total 100%

bratislav

So again with RSTP on a VLAN that is attached to a Bridge, it is going to send out the BPDU packets to the interface, regardless of VLAN, right? Isn't that how RSTP works on most switches? Unless MSTP or PVSTP is implemented, this is now normal operation mode which is 'normal' to switches operating...

bratislav

Would having MSTP option solve this issue?

Unfortunately Mikrotik is just ignoring this issue and sticks with 16 years old RSTP standard ...

bratislav

No it does not ...
It has been requested but to no avail>
viewtopic.php?t=44921

bratislav

wireless snooper result don't indented in winbox 3.x

What do you mean ...

It seams OK to me ...

bratislav

Could you please add a scroll bar to some windows?

It is unusable on smaller screens ... You could use WebFig for now ...

bratislav

SwOS Features: Rapid Spanning Tree Protocol (only) Is this really a feature in these day and age ... It seams to me MSTP is obligatory option (same as VLAN) for enterprise network switches ... I don't know of any ''serious" switch that does not support MSTP ... and every other vendor supports i...

bratislav

Actually there is one small annoyance in the latest versions of winbox ... If I click on a new session (menu/session/new) it does more or less nothing except deleting the IP address from the session text box and I stay connected to the same router but I am unable to close winbox any more ... or exit...

bratislav

I will ask once again..... This problem can be solved? It seems it was promised in version 3.0 http://fs5.directupload.net/images/170124/jswmnnj5.png You should check your display settings, custom screen font or similar, it works fine for the rest of us ... http://fs5.directupload.net/images/170126...

bratislav

Looks good so far ... upgrade from routeros-mipsbe-6.34.6 went without any issues and everything works fine ...

bratislav

Where can I configure LLDP, I cant find anything related to it in "/ip neighbor" or anywhere else. It seams still unimplemented http://forum.mikrotik.com/viewtopic.php?f=1&t=24690&start=50 They have already changed the documentation so we can only hope that it will "magically...

bratislav

My upgrade went well but the problem I have is that I can not disable wireless package, that is I can flag it for disablement but after reboot it is enabled again. Everyone who did lose wireless package or sees it as disabled after upgrade - can you please write to support@mikrotik.com and provide p...

bratislav

how do we enable/disable/check status of new feature loop from winbox? i cant find them in my rb2011 interface menu. is this only from terminal? It seems Loop protect feature is not available in this release ... from winbox 3.5 at least ... But it is working from command line: [admin@MikroTik2H] /i...

bratislav

After upgrade to 6.36 wireless-fp got removed as expected, but wireless-rep is missing. I got only wireless-cm2 atm. Where i can get wireless-rep from and is it backward compatible with older wireless packages? You can find it in Extra packages zip archive, it is backward compatible but you should...

bratislav

Upgrade from v6.34.2 to v6.34.5 deleted and disabled SSTP client configuration ... /interface sstp-client> print Flags: X - disabled, R - running 0 X name="sstp-rtv" max-mtu=1500 max-mru=1500 mrru=disabled connect-to=255.255.255.255:443 http-proxy=0.0.0.0:443 cert verify-server-certificate...

bratislav

Please specify what info would you like to get from LLDP?

You can start from here

:
http://vincentbernat.github.io/lldpd/features.html

The license for lldpd is permissive enough that you can even reuse the source ... and it is smart enough to support various protocols not only LLDP ...

bratislav

There is an ISC-licensed, open source implementation of LLDP called lldpd (obvioulsy :D ) that also supports CDP and other L2 discovery protocols. It is available on most Linuxes, Openwrt and others and it seams to me that MikroTik could use this to deliver LLDP in no time ... there is also ladvd th...

Search found 172 matches