v6.43.8 [stable] is released!

emils · Fri Dec 21, 2018 10:54 am

RouterOS version 6.43.8 has been released in public "stable" channel!

Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

What's new in 6.43.8 (2018-Dec-21 07:10):

MAJOR CHANGES IN v6.43.8:
----------------------
!) telnet - do not allow to set "tracefile" parameter;
----------------------

Changes in this release:

*) bridge - fixed IPv6 link-local address generation when auto-mac=yes;
*) capsman - fixed "group-key-update" parameter not using correct units;
*) crs3xx - improved data transmission between 10G and 1G ports;
*) console - properly remove system note after configuration reset;
*) dhcpv4-server - fixed dynamic lease reuse after expiration;
*) dhcpv6-server - properly handle DHCP requests that include prefix hint;
*) ethernet - fixed VLAN1 forwarding on RB1100AHx4 and RB4011 devices;
*) gps - added "coordinate-format" parameter;
*) led - fixed default LED configuration for RBMetalG-52SHPacn;
*) led - fixed PWR-LINE AP ethernet led polarity ("/system routerboard upgrade" required);
*) lte - disallow setting LTE interface as passthrough target;
*) lte - fixed DHCP IP acquire (introduced in v6.43.7);
*) lte - fixed passthrough functionality when interface is removed;
*) lte - increased reported "rsrq" precision;
*) lte - reset USB when non-default slot is used;
*) package - use bundled package by default if standalone packages are installed as well;
*) resource - fixed "total-memory" reporting on ARM devices;
*) snmp - added "tx-ccq" ("mtxrWlStatTxCCQ") and "rx-ccq" ("mtxrWlStatRxCCQ") values;
*) switch - fixed MAC learning when disabling interfaces on devices with Atheros8327 and QCA8337 switch chips;
*) system - fixed situation when all configuration was not properly loaded on bootup;
*) timezone - fixed "Europe/Dublin" time zone;
*) upgrade - automatically uninstall standalone package if already installed in bundle;
*) webfig - do not show bogus VHT field in wireless interface advanced mode;
*) winbox - added "allow-roaming" parameter in "Interface/LTE" menu;
*) winbox - allow to change VHT rates when 5ghz-n/ac band is used;
*) winbox - renamed "Radius" to "RADIUS";
*) winbox - show "Switch" menu on RB4011iGS+5HacQ2HnD and RB4011iGS+;
*) wireless - added new "installation" parameter to specify router's location;
*) wireless - improved stability for 802.11ac;
*) wireless - improvements in wireless frequency selection;

To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after some problem has appeared on device

Please keep this forum topic strictly related to this concrete RouterOS release.

sindudas · Fri Dec 21, 2018 11:25 am

On a wAP R LTE reports:

/interface lte info number=0
rsrp: -100dBm
rsrq: -15dB
sinr: -2dB
cqi: 4

But on Winbox:
RSRQ: -1.5 dB

Before update from 6.43.7 => 6.37.8 shows:
RSRQ: -15dB

What value is correct? As in changelog tells that:
*) lte - increased reported "rsrq" precision;

ErfanDL · Fri Dec 21, 2018 1:56 pm

) wireless - added new "installation" parameter to specify router's location;

Where is this option?

Sent from my C6833 using Tapatalk

mrz · Fri Dec 21, 2018 2:12 pm

In wireless interface settings obviously.

honzam · Fri Dec 21, 2018 3:07 pm

Any info about DFS?

kez · Fri Dec 21, 2018 3:45 pm

hello support!
Could you give us more information about this changelog entry?

*) wireless - improved stability for 802.11ac;

What have been changed? Any improvement in NV2?

Thanks!

Fri Dec 21, 2018 3:54 pm

Code: Select all
) wireless - added new "installation" parameter to specify router's location;
Where is this option?

Sent from my C6833 using Tapatalk

Screenshot 2018-12-21 at 14.09.39.png

ErfanDL · Fri Dec 21, 2018 4:39 pm

Code: Select all
) wireless - added new "installation" parameter to specify router's location;
Where is this option?

Sent from my C6833 using Tapatalk
Screenshot 2018-12-21 at 14.09.39.png

Thanks. Does it affects wifi power when selecting indoor or outdoor?

Sent from my C6833 using Tapatalk

awacenter · Fri Dec 21, 2018 4:51 pm

I have just update a RB951Ui from 6.42.1 to last ros version 6.43.8 and there is a little bug
because the log function dissapear.

I execute / log print and nothing appears.

hapi · Fri Dec 21, 2018 5:02 pm

OSPF randomly passes only part of the records to the routing table. It stops having fun.

mikelaurense · Fri Dec 21, 2018 9:40 pm

hello support!
Could you give us more information about this changelog entry?

*) wireless - improved stability for 802.11ac;

What have been changed? Any improvement in NV2?

Thanks!

Would like to know as well. My RB4011 keeps disabling 5ghz WiFi after a few days (see graph). Only a reboot can bring the WiFi up again. Wondering if this has been fixed

Redmor · Fri Dec 21, 2018 9:47 pm

Thank you very much for this present!
Now if I have a country set I can only use regulatory domain and default scanlist, a real pain in the a*s.
That should be in changelog!

eddieb · Fri Dec 21, 2018 11:18 pm

Updated from 6.43.7 to 6.43.8 without any problems.
Wifi works as expected, no problems

peterh · Sat Dec 22, 2018 12:01 am

Working fine on mAP and RB2011.

sff · Sat Dec 22, 2018 12:04 am

The reported fix to performance between 1Gb and 10Gb ports on CRS3xx series devices in 6.43.8 does not fix the issue. I've upgraded three CRS326 devices so far today, one from 6.43.4 and two from 6.43.7, and there has been no improvement. We ran extensive tests, all of which proved that while there was a "slight" increase in performance, as soon as you start to approach 100Mb of steady traffic going from (not to) a 1Gb port to a 10Gb uplink the 326 starts to fail to pass packets and performance drops significantly below 100Mb.

We've actually had to drop to 1Gb SFPs for the fiber uplinks to get ANY kind of performance above 20-30Mb/sec. As a 1Gb switch, it works great. 10Gb uplink? Back to the drawing board folks...I have 8 CRS317s (three groups of rings) and a core/edge of multiple CCR1072s/1036s that is waiting for a fix to be able to deploy.

No issue on 317s -- never had any. But the DOZENS of 326s that we have are pretty much boat anchors since the change to the way bridges are configured. The 226s we've been retiring may need to go back in service. They work -- if configured the "traditional" way instead of the new method of setting up VLANS.

Love Mikrotiks. Have hundreds of them. Don't love this bug.

hapi · Sat Dec 22, 2018 12:48 am

You write that 8 CRS317 are waiting for repair and then they do not have the problem. I do not understand.

I also have CRS317 and CRS328, and sometimes I do not have management on both the two and the data impediment.

Next time I prefer to buy something from UBNT where there is no problem.

sff · Sat Dec 22, 2018 1:13 am

No, they are waiting to be used. We deploying five new 10Gb backbones. Two of them are multiple switch RSTP rings between the three data centers, three are just ship to shore to handle backend storage for the server cluster and other high volume data such as cameras.

There are also two 1072s, two 1036s, four 1009s (w/10Gb port) waiting to cut over from the existing network.

Not that this is necessarily a "huge" network, but this is a summary of Mikrotiks deployed onsite right now. And yes, we still have several nearly ten year old RB1200s handling edge services for one of the external network connections.

Most maintenance/upgrades (as well as backups) have been automated using in-house developed databases, so other than devices that are offline at the moment, the ship looks like this:

+--------------------+----------+
| model | count(*) |
+--------------------+----------+
| | 1 |
| cAP | 23 |
| cAP ac | 1 |
| CCR1009-7G-1C-1S+ | 2 |
| CCR1009-8G-1S-1S+ | 4 |
| CCR1036-8G-2S+ | 2 |
| CCR1072-1G-8S+ | 2 |
| CRS106-1C-5S | 1 |
| CRS109-8G-1S-2HnD | 9 |
| CRS125-24G-1S-2HnD | 1 |
| CRS210-8G-2S+ | 3 |
| CRS212-1G-10S-1S+ | 6 |
| CRS226-24G-2S+ | 15 |
| CRS317-1G-16S+ | 10 |
| CRS326-24G-2S+ | 8 |
| CRS328-24P-4S+ | 4 |
| hAP ac | 12 |
| hAP ac lite | 3 |
| mAP | 1 |
| RB Groove A-52HPn | 1 |
| RB SXT 5HPnD | 2 |
| RB SXT G-2HnD | 3 |
| RB1200 | 3 |
| RB2011UAS | 2 |
| RB4011iGS+ | 2 |
| RB912UAG-5HPnD | 1 |
| RB951G-2HnD | 25 |
| SXT SA5 ac | 2 |
| unknown | 2 |
| wAP ac | 3 |
+--------------------+----------+
30 rows in set (0.00 sec)

MariaDB [mikrotik]>

+----------+----------+
| routeros | count(*) |
+----------+----------+
| | 1 |
| 6.38.3 | 1 |
| 6.40.2 | 7 |
| 6.40.5 | 14 |
| 6.42.6 | 1 |
| 6.42.7 | 3 |
| 6.43.4 | 113 |
| 6.43.7 | 4 |
| 6.43.8 | 8 |
| Unknown | 2 |
+----------+----------+
10 rows in set (0.00 sec)

Most of the network is on 6.43, but a lot of the crs226s have been kept back on 6.40 waiting for maintenance time to upgrade the "old style" configurations.

There are also a dozen or so HP and Netgear switches still to be decommissioned. The 1072s, 1036s and most of the 317s are in part of the network that we are upgrading from a single 10Gb ring to five distinct connections ship to shore. There are sometimes more than ten thousand active mac addresses visible during the day. The dynamic DHCP pool is multiple /16s.

This is an aircraft carrier.

anav · Sat Dec 22, 2018 3:01 am

Has anyone at Mikrotik investigated this report??
viewtopic.php?f=2&t=143065

Redmor · Sat Dec 22, 2018 3:09 am

Has anyone at Mikrotik investigated this report??
viewtopic.php?f=2&t=143065

It isn't a report, is a decision.
You should use only regulatory domain in some countries, but when you face to low quality transmission and TDMA, and occupied frequencies, what else can you do?

nichky · Sat Dec 22, 2018 9:00 am

i'm wondering what's differences between new "installation" and distance?
actually what the new feature does?

Thanks

amt · Sat Dec 22, 2018 10:04 am

i'm wondering what's differences between new "installation" and distance?
actually what the new feature does?

Thanks

me too

mistry7 · Sat Dec 22, 2018 10:19 am

i'm wondering what's differences between new "installation" and distance?
actually what the new feature does?

Thanks
me too

distance is for ACK calculation and installation ist foot frequency selection.....

nichky · Sat Dec 22, 2018 10:25 am

i'm wondering what's differences between new "installation" and distance?
actually what the new feature does?

Thanks
me too
distance is for ACK calculation and installation ist foot frequency selection.....

make sense ,but need more info

ognjen · Sat Dec 22, 2018 10:55 am

Hello,

I have a problem with wireless.
I getting internet from ISP Access Point [ROS: 6.27]. This link is 7 year old.
My station is RB433 and after upgrade from 6.43.7 to 6.43.8 link is drop down.
After troubleshooting i see diffence in Wireless tab.
On old conf, Frequency is 5920, Frequence Mode is superchannel, Conutry romania.
On new conf, Frequency is auto, Frequence Mode is regulary-domain, Conutry romania.
I cannot change back Frequency to 5920.
Can anyone help me? (I downgrade to 6.43.7 and push backup and this is work, but I won't use old ROS)

Before upgrade:

After upgrade:

Chupaka · Sat Dec 22, 2018 11:11 am

On old conf, Frequency is 5920, Frequence Mode is superchannel, Conutry romania.
On new conf, Frequency is auto, Frequence Mode is regulary-domain, Conutry romania.
I cannot change back Frequency to 5920.

Just set Country to no_country_set and use superchannel

ognjen · Sat Dec 22, 2018 11:30 am

Just set Country to no_country_set and use superchannel

That is it! Ty

honzam · Sat Dec 22, 2018 11:42 am

Thank you very much for this present!
Now if I have a country set I can only use regulatory domain and default scanlist, a real pain in the a*s.
That should be in changelog!

That is true

Sat Dec 22, 2018 1:21 pm

i'm wondering what's differences between new "installation" and distance?
actually what the new feature does?

Thanks

Distance adjusts ack settings.
Installation decides which frequencies and powers you can use, based on regulations.

Just set Country to no_country_set and use superchannel
That is it! Ty

Careful, this can bring you trouble, depending on which country you are in.

As it was always possible, check specifics in menu "/interface wireless info county-info germany" or other country.

[normis@rb4011] > interface wireless info country-info germany
  ranges: 2402-2482/b,g,gn20,gn40(20dBm)
          2417-2457/g-turbo(20dBm)
          5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/passive
          5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(20dBm)/dfs,passive
          5490-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(27dBm)/dfs,passive
          5190-5310/a-turbo(20dBm)/dfs
          5180-5300/a-turbo(20dBm)/dfs
          5520-5680/a-turbo(27dBm)/dfs,passive
          5510-5670/a-turbo(27dBm)/dfs,passive
          902-927/b,g,g-turbo,gn20,gn40(30dBm)

Sat Dec 22, 2018 1:38 pm

sindudas - We are sorry for any inconvenience caused. We will fix this problem in upcoming RouterOS releases.
ErfanDL - You can change value by using "/interface wireless set <interface> installation=any/indoor/outdoor".
honzam - What kind of information about DFS are you looking for?
kez - Sometimes router that was using "ac" did tend to reboot due to a Watchdog timer. This problem is now resolved. This does not mean that all "Watchdog reboots" are fixed in RouterOS. Usually such reboot happens on overloaded router.
ErfanDL, nichky, amt, mistry7 - This setting (installation) makes your router to take into account parts from "/interface wireless info country-info <country>" that specify usage in indoors or outdoors.
awacenter - What do you see when you run "/system logging export" command?
hapi - Please send supout.rif file from your router to support@mikrotik.com. Name from which version you did upgrade your router.
mikelaurense - Does interface actually gets disabled? Or it becomes inacessible? If it disabled, then someone has done that manually. Please provide supout.rif file tp support@mikrotik.com. Make sure that file is generated while interface is "disabled".
Redmor - Yes, but that is the whole point of country settings. You can still change settings in order to do so. Country settings are made in order to comply to regulatory domain.
sff - Have you contacted support@mikrotik.com regarding this matter. We have fixed suh bug in RouterOS already, however, your problem might be little bit different.
hapi - Please provide supout file from your router that would be generated while router is inaccessible either over another interface or over serial console. We will see why you can not access router at some point. I do not see any reason why you should jump tp consclusions right away and announce this as a "bug".
anav - Yes - "viewtopic.php?f=2&t=143065#p704717"
ognjen - In Europe (country selected) you can not use any other settings besides regulatory domain.

Sat Dec 22, 2018 1:42 pm

I think that "normis" post was missing "indoor/outdoor" setting in country information simply because example country does not have such limits.

Here you can see info for Latvia:

/interface wireless info country-info latvia
ranges: 2402-2482/b,g,gn20,gn40(20dBm)
2417-2457/g-turbo(20dBm)
5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/passive,indoor
5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(20dBm)/dfs,passive
5490-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(27dBm)/dfs,passive
5190-5310/a-turbo(20dBm)/dfs
5180-5300/a-turbo(20dBm)/dfs
5520-5680/a-turbo(27dBm)/dfs,passive
5510-5670/a-turbo(27dBm)/dfs,passive
902-927/b,g,g-turbo,gn20,gn40(30dBm)

These settings can be used only if any or indoor is selected on wireless interface. If you select outdoor, then you can not use this part. Same rules apply if info says "outdoor" - indoor configuration will not be able to use it:

"5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/passive,indoor"

Redmor · Sat Dec 22, 2018 2:35 pm

strods I'm not saying that this change is wrong, it should work like that, but:
1. Write it in changelog
2. If you have to update and set regulatory domain for countries, why removing superchannel with country set instead of unsetting country with superchannel set?

Sat Dec 22, 2018 4:50 pm

You are right that there could have been two ways to adjust the inaccurate setting for some users.
We chose to adjust towards compliance, not towards incompliance. If user has set a country, he possibly wanted to be compliant already.

yottabit · Sat Dec 22, 2018 6:24 pm

All of my MIPS devices (5x hAP ac, 2x RB951) upgraded automatically last night by script.

My one ARM device (hAP ac2) did not upgrade, logging that there were no updates available.

I tried to update it this morning from /system packages, and it still reports no updates are available. It's still on 6.43.7.

Was the upgrade removed for ARM?

The file downloads successfully from the Mikrotik webpage.

Sent from my Pixel 3 using Tapatalk

Sat Dec 22, 2018 7:56 pm

yottabit - To which IP address does your router resolve upgrade.mikrotik.com (:put [:resolve upgrade.mikrotik.com])? Upgrade should work on this router without any problems. There might be some proxy server between your router and upgrade server causing this.

yottabit · Sat Dec 22, 2018 8:03 pm

yottabit - To which IP address does your router resolve upgrade.mikrotik.com (:put [:resolve upgrade.mikrotik.com])? Upgrade should work on this router without any problems. There might be some proxy server between your router and upgrade server causing this.

[yottabit@rb1] > /ip dns print
                      servers: 8.8.8.8,8.8.4.4
              dynamic-servers: 
        allow-remote-requests: yes
          max-udp-packet-size: 4096
         query-server-timeout: 2s
          query-total-timeout: 10s
       max-concurrent-queries: 100
  max-concurrent-tcp-sessions: 20
                   cache-size: 2048KiB
                cache-max-ttl: 1w
                   cache-used: 205KiB
[yottabit@rb1] > :put [:resolve upgrade.mikrotik.com]
159.148.147.204
[yottabit@rb1] > /system package update check-for-updates 
            channel: stable
  installed-version: 6.43.7
             status: ERROR: connection timed out

Strange, right? It's also worth noting that all but 2 of the other routers I mentioned above are behind this router that won't upgrade, and are forced to use this router for DNS. There is no proxy.

Edit: switched to OpenDNS, and the resolve is the same, but still can't connect.

[yottabit@rb1] > /ip dns print 
                      servers: 208.67.222.123,208.67.220.123
              dynamic-servers: 
        allow-remote-requests: yes
          max-udp-packet-size: 4096
         query-server-timeout: 2s
          query-total-timeout: 10s
       max-concurrent-queries: 100
  max-concurrent-tcp-sessions: 20
                   cache-size: 2048KiB
                cache-max-ttl: 1w
                   cache-used: 139KiB
[yottabit@rb1] > /ip dns cache flush
[yottabit@rb1] > :put [:resolve upgrade.mikrotik.com]     
159.148.172.226
[yottabit@rb1] > :put [:resolve upgrade.mikrotik.com]
159.148.147.204
[yottabit@rb1] > /system package update check-for-updates 
            channel: stable
  installed-version: 6.43.7
             status: ERROR: connection timed out

Edit again, nevermind, figured it out. It was new firewall rule I had implemented a while back, since the last upgrade. I guess I need to add an "allow related, etc." rule above the tarpit rule:

 3    ;;; tarpit WAN
      chain=input action=tarpit protocol=tcp in-interface-list=WAN log=no log-prefix="tarpit"

Sorry for the false alarm.

This fixed it, for anyone playing along:

 3    ;;; Accept WAN established,related before tarpit
      chain=input action=accept connection-state=established,related in-interface-list=WAN log=no log-prefix="" 

 4    ;;; tarpit WAN
      chain=input action=tarpit protocol=tcp in-interface-list=WAN log=no log-prefix="tarpit"

nichky · Sat Dec 22, 2018 9:29 pm

I think that "normis" post was missing "indoor/outdoor" setting in country information simply because example country does not have such limits.

Here you can see info for Latvia:

/interface wireless info country-info latvia
ranges: 2402-2482/b,g,gn20,gn40(20dBm)
2417-2457/g-turbo(20dBm)
5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/passive,indoor
5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(20dBm)/dfs,passive
5490-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(27dBm)/dfs,passive
5190-5310/a-turbo(20dBm)/dfs
5180-5300/a-turbo(20dBm)/dfs
5520-5680/a-turbo(27dBm)/dfs,passive
5510-5670/a-turbo(27dBm)/dfs,passive
902-927/b,g,g-turbo,gn20,gn40(30dBm)

These settings can be used only if any or indoor is selected on wireless interface. If you select outdoor, then you can not use this part. Same rules apply if info says "outdoor" - indoor configuration will not be able to use it:

"5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/passive,indoor"

Can i ask you i have already updated to the later Router, why i couldn't get same result like you? Have a look:

Thanks

nichky · Sat Dec 22, 2018 9:36 pm

i'm wondering what's differences between new "installation" and distance?
actually what the new feature does?

Thanks
Distance adjusts ack settings.
Installation decides which frequencies and powers you can use, based on regulations.

So normis basically it means we always have to look what this command says:

/interface wireless info county-info xxx

And dependent of that we can use indoor or outdoor ( regulatory domain)

Thanks

Just set Country to no_country_set and use superchannel
That is it! Ty
Careful, this can bring you trouble, depending on which country you are in.

As it was always possible, check specifics in menu "/interface wireless info county-info germany" or other country.
Code: Select all
[normis@rb4011] > interface wireless info country-info germany
  ranges: 2402-2482/b,g,gn20,gn40(20dBm)
          2417-2457/g-turbo(20dBm)
          5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/passive
          5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(20dBm)/dfs,passive
          5490-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(27dBm)/dfs,passive
          5190-5310/a-turbo(20dBm)/dfs
          5180-5300/a-turbo(20dBm)/dfs
          5520-5680/a-turbo(27dBm)/dfs,passive
          5510-5670/a-turbo(27dBm)/dfs,passive
          902-927/b,g,g-turbo,gn20,gn40(30dBm)
       

Sat Dec 22, 2018 9:44 pm

Can you provide supout file to support@mikrotik.com? Honestly, I do not see how (if you did not play around with Photoshop

) you could get this information under country info.

Screenshot 2018-12-22 21.41.45.png

Redmor · Sat Dec 22, 2018 9:46 pm

You are right that there could have been two ways to adjust the inaccurate setting for some users.
We chose to adjust towards compliance, not towards incompliance. If user has set a country, he possibly wanted to be compliant already.

I don't think that a user using superchannel with a country set wants to be compliant and I think the second option (changing country on update) is the best option.
In the end, these are things that should be written in changelog, I think lots of users lost CPE connection for this update.

nichky · Sat Dec 22, 2018 9:54 pm

Can you provide supout file to support@mikrotik.com? Honestly, I do not see how (if you did not play around with Photoshop ) you could get this information under country info.

Screenshot 2018-12-22 21.41.45.png

I dare not play with you.

you can see from other device

Sat Dec 22, 2018 10:29 pm

nichky - "/interface wireless export verbose" should tell us why your output differs from mine.

nichky · Sat Dec 22, 2018 10:38 pm

nichky - "/interface wireless export verbose" should tell us why your output differs from mine.

However i send to you rif file. from your last command

sutrus · Sat Dec 22, 2018 11:22 pm

The same result - RB962, 2 x SXT HG5 ac

[admin@MikroTik962_Fug31] /interface wireless info> country-info "czech republic" 
  ranges: 2402-2482/b,g,gn20,gn40(20dBm)
          2417-2457/g-turbo(20dBm)
          5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/passive
          5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(20dBm)/dfs,passive
          5490-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(27dBm)/dfs,passive
          5190-5310/a-turbo(20dBm)/dfs
          5180-5300/a-turbo(20dBm)/dfs
          5520-5680/a-turbo(27dBm)/dfs,passive
          5510-5670/a-turbo(27dBm)/dfs,passive
          902-927/b,g,g-turbo,gn20,gn40(30dBm)

# dec/22/2018 22:08:30 by RouterOS 6.43.8
# software id = Y9WG-XJW8
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = 6F1206AB3E12
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk disable-pmkid=no eap-methods="" group-ciphers=aes-ccm \
    group-key-update=1h interim-update=0s management-protection=disabled management-protection-key="" mode=\
    dynamic-keys mschapv2-password="" mschapv2-username="" name=default radius-called-format=mac:ssid \
    radius-eap-accounting=no radius-mac-accounting=no radius-mac-authentication=no radius-mac-caching=disabled \
    radius-mac-format=XX:XX:XX:XX:XX:XX radius-mac-mode=as-username static-algo-0=none static-algo-1=none \
    static-algo-2=none static-algo-3=none static-key-0="" static-key-1="" static-key-2="" static-key-3="" \
    static-sta-private-algo=none static-sta-private-key="" static-transmit-key=key-0 supplicant-identity=MikroTik \
    tls-certificate=none tls-mode=no-certificates unicast-ciphers=aes-ccm wpa-pre-shared-key="" wpa2-pre-shared-key=\
add authentication-types=wpa2-psk disable-pmkid=yes eap-methods="" group-ciphers=aes-ccm group-key-update=1h \
    interim-update=0s management-protection=disabled management-protection-key="" mode=dynamic-keys \
    mschapv2-password="" mschapv2-username="" name=WPA2 radius-called-format=mac:ssid radius-eap-accounting=no \
    radius-mac-accounting=no radius-mac-authentication=no radius-mac-caching=disabled radius-mac-format=\
    XX:XX:XX:XX:XX:XX radius-mac-mode=as-username static-algo-0=none static-algo-1=none static-algo-2=none \
    static-algo-3=none static-key-0="" static-key-1="" static-key-2="" static-key-3="" static-sta-private-algo=none \
    static-sta-private-key="" static-transmit-key=key-0 supplicant-identity=MikroTik tls-certificate=none tls-mode=\
    no-certificates unicast-ciphers=aes-ccm wpa-pre-shared-key="" wpa2-pre-shared-key=
/interface wireless
set [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode allow-sharedkey=no ampdu-priorities=\
    0,1,2,3,4,5,6,7 amsdu-limit=8192 amsdu-threshold=8192 antenna-gain=0 area="" arp=enabled arp-timeout=auto band=\
    2ghz-g/n basic-rates-a/g=24Mbps,36Mbps,48Mbps,54Mbps basic-rates-b="" bridge-mode=enabled channel-width=\
    20/40mhz-Ce compression=no country="czech republic" default-ap-tx-limit=0 default-authentication=yes \
    default-client-tx-limit=0 default-forwarding=yes disable-running-check=no disabled=no disconnect-timeout=3s \
    distance=indoors frame-lifetime=0 frequency=2412 frequency-mode=regulatory-domain frequency-offset=0 \
    guard-interval=any hide-ssid=no ht-basic-mcs=mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7 ht-supported-mcs="mcs\
    -0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7,mcs-8,mcs-9,mcs-10,mcs-11,mcs-12,mcs-13,mcs-14,mcs-15,mcs-16,mcs-17,m\
    cs-18,mcs-19,mcs-20,mcs-21,mcs-22,mcs-23" hw-fragmentation-threshold=disabled hw-protection-mode=cts-to-self \
    hw-protection-threshold=0 hw-retries=4 installation=indoor interworking-profile=disabled keepalive-frames=enabled \
    l2mtu=1600 mac-address=6C:3B:6B:42:3D:5A max-station-count=20 mode=ap-bridge mtu=1500 multicast-buffering=enabled \
    multicast-helper=full name=wlan1-2.4GHz noise-floor-threshold=default nv2-cell-radius=30 nv2-downlink-ratio=50 \
    nv2-mode=dynamic-downlink nv2-noise-floor-offset=default nv2-preshared-key="" nv2-qos=default nv2-queue-count=2 \
    nv2-security=disabled nv2-sync-secret="" on-fail-retry-time=100ms preamble-mode=both radio-name=6C3B6B423D5A \
    rate-selection=advanced rate-set=default rx-chains=0,1,2 scan-list=default secondary-channel="" security-profile=\
    WPA2 ssid=sutrus_fug31 station-bridge-clone-mac=00:00:00:00:00:00 station-roaming=enabled supported-rates-a/g=\
    24Mbps,36Mbps,48Mbps,54Mbps supported-rates-b="" tdma-period-size=2 tx-chains=0,1,2 tx-power-mode=default \
    update-stats-interval=disabled vlan-id=1 vlan-mode=no-tag wds-cost-range=50-150 wds-default-bridge=none \
    wds-default-cost=100 wds-ignore-ssid=no wds-mode=disabled wireless-protocol=802.11 wmm-support=enabled wps-mode=\
    disabled
    set [ find default-name=wlan2 ] adaptive-noise-immunity=ap-and-client-mode allow-sharedkey=no ampdu-priorities=\
    0,1,2,3,4,5,6,7 amsdu-limit=8192 amsdu-threshold=8192 antenna-gain=0 area="" arp=enabled arp-timeout=auto band=\
    5ghz-a/n/ac basic-rates-a/g=6Mbps bridge-mode=enabled channel-width=20/40/80mhz-Ceee compression=no country=\
    "czech republic" default-ap-tx-limit=0 default-authentication=yes default-client-tx-limit=0 default-forwarding=\
    yes disable-running-check=no disabled=no disconnect-timeout=3s distance=indoors frame-lifetime=0 frequency=5180 \
    frequency-mode=regulatory-domain frequency-offset=0 guard-interval=any hide-ssid=no ht-basic-mcs=\
    mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7 ht-supported-mcs="mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7,\
    mcs-8,mcs-9,mcs-10,mcs-11,mcs-12,mcs-13,mcs-14,mcs-15,mcs-16,mcs-17,mcs-18,mcs-19,mcs-20,mcs-21,mcs-22,mcs-23" \
    hw-fragmentation-threshold=disabled hw-protection-mode=none hw-protection-threshold=0 hw-retries=7 installation=\
    indoor interworking-profile=disabled keepalive-frames=enabled l2mtu=1600 mac-address=6C:3B:6B:42:3D:59 \
    max-station-count=2007 mode=ap-bridge mtu=1500 multicast-buffering=enabled multicast-helper=full name=wlan2-5GHz \
    nv2-cell-radius=30 nv2-downlink-ratio=50 nv2-mode=dynamic-downlink nv2-preshared-key="" nv2-qos=default \
    nv2-queue-count=2 nv2-security=disabled nv2-sync-secret="" on-fail-retry-time=100ms preamble-mode=long \
    radio-name=6C3B6B423D59 rate-selection=advanced rate-set=default rx-chains=0,1,2 scan-list=default \
    secondary-channel="" security-profile=WPA2 ssid=sutrus_fug31_5G station-bridge-clone-mac=00:00:00:00:00:00 \
    station-roaming=enabled supported-rates-a/g=6Mbps,9Mbps,12Mbps,18Mbps,24Mbps,36Mbps,48Mbps,54Mbps \
    tdma-period-size=2 tx-chains=0,1,2 tx-power-mode=default update-stats-interval=disabled vht-basic-mcs=mcs0-7 \
    vht-supported-mcs=mcs0-9,mcs0-9,mcs0-9 vlan-id=1 vlan-mode=no-tag wds-cost-range=50-150 wds-default-bridge=none \
    wds-default-cost=100 wds-ignore-ssid=no wds-mode=disabled wireless-protocol=802.11 wmm-support=enabled wps-mode=\
    disabled
/interface wireless manual-tx-power-table
set wlan1-2.4GHz manual-tx-powers="1Mbps:17,2Mbps:17,5.5Mbps:17,11Mbps:17,6Mbps:17,9Mbps:17,12Mbps:17,18Mbps:17,24Mbps\
    :17,36Mbps:17,48Mbps:17,54Mbps:17,HT20-0:17,HT20-1:17,HT20-2:17,HT20-3:17,HT20-4:17,HT20-5:17,HT20-6:17,HT20-7:17,\
    HT40-0:17,HT40-1:17,HT40-2:17,HT40-3:17,HT40-4:17,HT40-5:17,HT40-6:17,HT40-7:17"
set wlan2-5GHz manual-tx-powers="1Mbps:17,2Mbps:17,5.5Mbps:17,11Mbps:17,6Mbps:17,9Mbps:17,12Mbps:17,18Mbps:17,24Mbps:1\
    7,36Mbps:17,48Mbps:17,54Mbps:17,HT20-0:17,HT20-1:17,HT20-2:17,HT20-3:17,HT20-4:17,HT20-5:17,HT20-6:17,HT20-7:17,HT\
    40-0:17,HT40-1:17,HT40-2:17,HT40-3:17,HT40-4:17,HT40-5:17,HT40-6:17,HT40-7:17"
/interface wireless nstreme
set wlan1-2.4GHz disable-csma=no enable-nstreme=no enable-polling=no framer-limit=3200 framer-policy=none
set wlan2-5GHz disable-csma=no enable-nstreme=no enable-polling=no framer-limit=3200 framer-policy=none
/interface wireless align
set active-mode=yes audio-max=-20 audio-min=-100 audio-monitor=00:00:00:00:00:00 filter-mac=00:00:00:00:00:00 \
    frame-size=300 frames-per-second=25 receive-all=no ssid-all=yes
/interface wireless cap
set bridge=bridgeLocal caps-man-addresses="" caps-man-certificate-common-names="" caps-man-names="" certificate=none \
    discovery-interfaces=bridgeLocal enabled=no interfaces=wlan1-2.4GHz,wlan2-5GHz lock-to-caps-man=no \
    static-virtual=no
/interface wireless sniffer
set channel-time=200ms file-limit=10 file-name="" memory-limit=10 multiple-channels=no only-headers=no \
    receive-errors=no streaming-enabled=no streaming-max-rate=0 streaming-server=0.0.0.0
/interface wireless snooper
set channel-time=200ms multiple-channels=yes receive-errors=no

nichky · Sat Dec 22, 2018 11:27 pm

The same result - RB962, 2 x SXT HG5 ac

[admin@MikroTik962_Fug31] /interface wireless info> country-info "czech republic" 
  ranges: 2402-2482/b,g,gn20,gn40(20dBm)
          2417-2457/g-turbo(20dBm)
          5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/passive
          5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(20dBm)/dfs,passive
          5490-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(27dBm)/dfs,passive
          5190-5310/a-turbo(20dBm)/dfs
          5180-5300/a-turbo(20dBm)/dfs
          5520-5680/a-turbo(27dBm)/dfs,passive
          5510-5670/a-turbo(27dBm)/dfs,passive
          902-927/b,g,g-turbo,gn20,gn40(30dBm)

# dec/22/2018 22:08:30 by RouterOS 6.43.8
# software id = Y9WG-XJW8
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = 6F1206AB3E12
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk disable-pmkid=no eap-methods="" group-ciphers=aes-ccm \
    group-key-update=1h interim-update=0s management-protection=disabled management-protection-key="" mode=\
    dynamic-keys mschapv2-password="" mschapv2-username="" name=default radius-called-format=mac:ssid \
    radius-eap-accounting=no radius-mac-accounting=no radius-mac-authentication=no radius-mac-caching=disabled \
    radius-mac-format=XX:XX:XX:XX:XX:XX radius-mac-mode=as-username static-algo-0=none static-algo-1=none \
    static-algo-2=none static-algo-3=none static-key-0="" static-key-1="" static-key-2="" static-key-3="" \
    static-sta-private-algo=none static-sta-private-key="" static-transmit-key=key-0 supplicant-identity=MikroTik \
    tls-certificate=none tls-mode=no-certificates unicast-ciphers=aes-ccm wpa-pre-shared-key="" wpa2-pre-shared-key=\
add authentication-types=wpa2-psk disable-pmkid=yes eap-methods="" group-ciphers=aes-ccm group-key-update=1h \
    interim-update=0s management-protection=disabled management-protection-key="" mode=dynamic-keys \
    mschapv2-password="" mschapv2-username="" name=WPA2 radius-called-format=mac:ssid radius-eap-accounting=no \
    radius-mac-accounting=no radius-mac-authentication=no radius-mac-caching=disabled radius-mac-format=\
    XX:XX:XX:XX:XX:XX radius-mac-mode=as-username static-algo-0=none static-algo-1=none static-algo-2=none \
    static-algo-3=none static-key-0="" static-key-1="" static-key-2="" static-key-3="" static-sta-private-algo=none \
    static-sta-private-key="" static-transmit-key=key-0 supplicant-identity=MikroTik tls-certificate=none tls-mode=\
    no-certificates unicast-ciphers=aes-ccm wpa-pre-shared-key="" wpa2-pre-shared-key=
/interface wireless
set [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode allow-sharedkey=no ampdu-priorities=\
    0,1,2,3,4,5,6,7 amsdu-limit=8192 amsdu-threshold=8192 antenna-gain=0 area="" arp=enabled arp-timeout=auto band=\
    2ghz-g/n basic-rates-a/g=24Mbps,36Mbps,48Mbps,54Mbps basic-rates-b="" bridge-mode=enabled channel-width=\
    20/40mhz-Ce compression=no country="czech republic" default-ap-tx-limit=0 default-authentication=yes \
    default-client-tx-limit=0 default-forwarding=yes disable-running-check=no disabled=no disconnect-timeout=3s \
    distance=indoors frame-lifetime=0 frequency=2412 frequency-mode=regulatory-domain frequency-offset=0 \
    guard-interval=any hide-ssid=no ht-basic-mcs=mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7 ht-supported-mcs="mcs\
    -0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7,mcs-8,mcs-9,mcs-10,mcs-11,mcs-12,mcs-13,mcs-14,mcs-15,mcs-16,mcs-17,m\
    cs-18,mcs-19,mcs-20,mcs-21,mcs-22,mcs-23" hw-fragmentation-threshold=disabled hw-protection-mode=cts-to-self \
    hw-protection-threshold=0 hw-retries=4 installation=indoor interworking-profile=disabled keepalive-frames=enabled \
    l2mtu=1600 mac-address=6C:3B:6B:42:3D:5A max-station-count=20 mode=ap-bridge mtu=1500 multicast-buffering=enabled \
    multicast-helper=full name=wlan1-2.4GHz noise-floor-threshold=default nv2-cell-radius=30 nv2-downlink-ratio=50 \
    nv2-mode=dynamic-downlink nv2-noise-floor-offset=default nv2-preshared-key="" nv2-qos=default nv2-queue-count=2 \
    nv2-security=disabled nv2-sync-secret="" on-fail-retry-time=100ms preamble-mode=both radio-name=6C3B6B423D5A \
    rate-selection=advanced rate-set=default rx-chains=0,1,2 scan-list=default secondary-channel="" security-profile=\
    WPA2 ssid=sutrus_fug31 station-bridge-clone-mac=00:00:00:00:00:00 station-roaming=enabled supported-rates-a/g=\
    24Mbps,36Mbps,48Mbps,54Mbps supported-rates-b="" tdma-period-size=2 tx-chains=0,1,2 tx-power-mode=default \
    update-stats-interval=disabled vlan-id=1 vlan-mode=no-tag wds-cost-range=50-150 wds-default-bridge=none \
    wds-default-cost=100 wds-ignore-ssid=no wds-mode=disabled wireless-protocol=802.11 wmm-support=enabled wps-mode=\
    disabled
    set [ find default-name=wlan2 ] adaptive-noise-immunity=ap-and-client-mode allow-sharedkey=no ampdu-priorities=\
    0,1,2,3,4,5,6,7 amsdu-limit=8192 amsdu-threshold=8192 antenna-gain=0 area="" arp=enabled arp-timeout=auto band=\
    5ghz-a/n/ac basic-rates-a/g=6Mbps bridge-mode=enabled channel-width=20/40/80mhz-Ceee compression=no country=\
    "czech republic" default-ap-tx-limit=0 default-authentication=yes default-client-tx-limit=0 default-forwarding=\
    yes disable-running-check=no disabled=no disconnect-timeout=3s distance=indoors frame-lifetime=0 frequency=5180 \
    frequency-mode=regulatory-domain frequency-offset=0 guard-interval=any hide-ssid=no ht-basic-mcs=\
    mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7 ht-supported-mcs="mcs-0,mcs-1,mcs-2,mcs-3,mcs-4,mcs-5,mcs-6,mcs-7,\
    mcs-8,mcs-9,mcs-10,mcs-11,mcs-12,mcs-13,mcs-14,mcs-15,mcs-16,mcs-17,mcs-18,mcs-19,mcs-20,mcs-21,mcs-22,mcs-23" \
    hw-fragmentation-threshold=disabled hw-protection-mode=none hw-protection-threshold=0 hw-retries=7 installation=\
    indoor interworking-profile=disabled keepalive-frames=enabled l2mtu=1600 mac-address=6C:3B:6B:42:3D:59 \
    max-station-count=2007 mode=ap-bridge mtu=1500 multicast-buffering=enabled multicast-helper=full name=wlan2-5GHz \
    nv2-cell-radius=30 nv2-downlink-ratio=50 nv2-mode=dynamic-downlink nv2-preshared-key="" nv2-qos=default \
    nv2-queue-count=2 nv2-security=disabled nv2-sync-secret="" on-fail-retry-time=100ms preamble-mode=long \
    radio-name=6C3B6B423D59 rate-selection=advanced rate-set=default rx-chains=0,1,2 scan-list=default \
    secondary-channel="" security-profile=WPA2 ssid=sutrus_fug31_5G station-bridge-clone-mac=00:00:00:00:00:00 \
    station-roaming=enabled supported-rates-a/g=6Mbps,9Mbps,12Mbps,18Mbps,24Mbps,36Mbps,48Mbps,54Mbps \
    tdma-period-size=2 tx-chains=0,1,2 tx-power-mode=default update-stats-interval=disabled vht-basic-mcs=mcs0-7 \
    vht-supported-mcs=mcs0-9,mcs0-9,mcs0-9 vlan-id=1 vlan-mode=no-tag wds-cost-range=50-150 wds-default-bridge=none \
    wds-default-cost=100 wds-ignore-ssid=no wds-mode=disabled wireless-protocol=802.11 wmm-support=enabled wps-mode=\
    disabled
/interface wireless manual-tx-power-table
set wlan1-2.4GHz manual-tx-powers="1Mbps:17,2Mbps:17,5.5Mbps:17,11Mbps:17,6Mbps:17,9Mbps:17,12Mbps:17,18Mbps:17,24Mbps\
    :17,36Mbps:17,48Mbps:17,54Mbps:17,HT20-0:17,HT20-1:17,HT20-2:17,HT20-3:17,HT20-4:17,HT20-5:17,HT20-6:17,HT20-7:17,\
    HT40-0:17,HT40-1:17,HT40-2:17,HT40-3:17,HT40-4:17,HT40-5:17,HT40-6:17,HT40-7:17"
set wlan2-5GHz manual-tx-powers="1Mbps:17,2Mbps:17,5.5Mbps:17,11Mbps:17,6Mbps:17,9Mbps:17,12Mbps:17,18Mbps:17,24Mbps:1\
    7,36Mbps:17,48Mbps:17,54Mbps:17,HT20-0:17,HT20-1:17,HT20-2:17,HT20-3:17,HT20-4:17,HT20-5:17,HT20-6:17,HT20-7:17,HT\
    40-0:17,HT40-1:17,HT40-2:17,HT40-3:17,HT40-4:17,HT40-5:17,HT40-6:17,HT40-7:17"
/interface wireless nstreme
set wlan1-2.4GHz disable-csma=no enable-nstreme=no enable-polling=no framer-limit=3200 framer-policy=none
set wlan2-5GHz disable-csma=no enable-nstreme=no enable-polling=no framer-limit=3200 framer-policy=none
/interface wireless align
set active-mode=yes audio-max=-20 audio-min=-100 audio-monitor=00:00:00:00:00:00 filter-mac=00:00:00:00:00:00 \
    frame-size=300 frames-per-second=25 receive-all=no ssid-all=yes
/interface wireless cap
set bridge=bridgeLocal caps-man-addresses="" caps-man-certificate-common-names="" caps-man-names="" certificate=none \
    discovery-interfaces=bridgeLocal enabled=no interfaces=wlan1-2.4GHz,wlan2-5GHz lock-to-caps-man=no \
    static-virtual=no
/interface wireless sniffer
set channel-time=200ms file-limit=10 file-name="" memory-limit=10 multiple-channels=no only-headers=no \
    receive-errors=no streaming-enabled=no streaming-max-rate=0 streaming-server=0.0.0.0
/interface wireless snooper
set channel-time=200ms multiple-channels=yes receive-errors=no

change with country-info latvia and post the result

sff · Sat Dec 22, 2018 11:28 pm

Nope. Haven't contacted support. I'm in the US on "eastern" time, so support lag time tends to be rather large. All parts in the connection are Mikrotik (no 3rd party SFPs involved), and the problem appears with a 10Gb link between the switches and goes away with 1Gb. Very clearly what they say they fixed but clearly didn't. It is absolutely the same issue. 1Gb port going through a 10Gb fiber uplink going to a 1Gb port at the other location.

Switches correctly configured, hardware offload setup correctly, all VLANS defined as recommended. Direct single mode fiber link between the switches (one on shore, the other on the Yorktown about 550m run down the pier and up to the data center under the flight deck). 10Gb SFPs can't handle even 100Mb of throughput. 1Gb SFPs deliver rated throughput perfectly.

I also ran a speed test here from my Mac through a [correctly configured] CRS109 uplinked to a CRS226 then 10Gb DAC to a CRS317, to a 10Gb port on a CCR1036 out another 10Gb port into another VLAN on the same 317, then into a server via 10Gb DAC to a local speedtest server. Return path. 1000Mb+ in both directions. That's an old 109, a 226, a 317 and a 1036. All Mikrotik gear until we hit the server. 1Gb and getting full 1Gb throughput with no dropped packets.

I just got a new CRS317 that arrived Friday that will be configured to match the CRS226 and I'll run the same test. But this is the Saturday before xmas and I'm busy keeping all the 3D printers going making tree ornaments (mostly star wars stormtrooper angels) so this is on the back burner until tomorrow.

sff · Sat Dec 22, 2018 11:29 pm

Sorry...meant to say a new CRS326 that arrived yesterday. Long day. One of the printers has been fighting me and requiring quite a bit of attention.

sff · Sat Dec 22, 2018 11:31 pm

And of course I have to wait until the printers are finished what they are running now, since the printer file storage is NFS and the path passes through the same 317/226 (but to a different 109).

sutrus · Sat Dec 22, 2018 11:38 pm

change with country-info latvia and post the result

[admin@MikroTik962_Fug31] > /interface wireless info country-info latvia 
  ranges: 2402-2482/b,g,gn20,gn40(20dBm)
          2417-2457/g-turbo(20dBm)
          5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/passive
          5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(20dBm)/dfs,passive
          5490-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(27dBm)/dfs,passive
          5190-5310/a-turbo(20dBm)/dfs
          5180-5300/a-turbo(20dBm)/dfs
          5520-5680/a-turbo(27dBm)/dfs,passive
          5510-5670/a-turbo(27dBm)/dfs,passive
          902-927/b,g,g-turbo,gn20,gn40(30dBm)

DimaFIX · Sun Dec 23, 2018 12:32 am

Symbol: ` in WLAN SSID brake all wlan interfaces.
Or even not a symbol, but a virtual WLAN. When I create a virtual WLAN and reboot hap ac^2, I don't see all interfaces and export doesn't work in the console.

yottabit · Sun Dec 23, 2018 2:16 am

Symbol: ` in WLAN SSID brake all wlan interfaces.
Or even not a symbol, but a virtual WLAN. When I create a virtual WLAN and reboot hap ac^2, I don't see all interfaces and export doesn't work in the console.

Is this new? 802.11 spec specifies SSID can be up to 32 bytes. It does NOT require alpha-numeric, printable, etc. Therefore ` should be legal as well as NUL character, trailing space, etc.

This is fresh in my mind because just last week I helped a colleague troubleshoot a new device not connecting to his MikroTik Wi-Fi network. The problem was a trailing space in his SSID, so the fault of the new device.

Therefore using string operations, such as strcopy() is not the correct method. Either way, ` should be valid even in that function. MikroTik should ensure they're allowing any character, and figure out how to properly escape them in the CLI export, which by default would not allow non-printable exports/imports.

Cisco doesn't allow certain characters, or trailing space, but that's also against the spec.

Sent from my Pixel 3 using Tapatalk

Sun Dec 23, 2018 8:18 am

nichky - Thanks for all the information. Upcoming RouterOS releases will show indoor/outdoor parameters under country-info output. Sorry for any inconvenience caused.
sff - Any supout.rif file will tell us more than a thousand words. Support usually replies within three Latvian business days. Sometimes (like during holiday or MUM season) it might take a little bit longer, but you will never be left without a response. Please write an e-mail to us and we will try to help you. Lets not keep this discussion open under 6.43.8 topic which is not related to your problem.
DimaFIX - Please send supout.rif file from your router to support@mikrotik.com. If I add such symbol to my wireless interfaces SSID, then it continue to work properly.
yottabit - As stated one line above, we can not confirm that there is such problem. First of all, there are no SSID related changes in this version and I can not seem to reproduce such problem when I use "`" symbol in SSID.

tonymobile · Sun Dec 23, 2018 9:09 am

You are right that there could have been two ways to adjust the inaccurate setting for some users.
We chose to adjust towards compliance, not towards incompliance. If user has set a country, he possibly wanted to be compliant already.

When will you understand that it is now impossible to conform?

Unfortunately, the 5 ghz band has collapsed, and we defend ourselves as we can.

You've probably been the victim of some compliance check!

You have to improve wireless performance absolutely, otherwise mikrotik will have a short life.

Take a look mimosa, cambium (I do not want to put ubiquiti in question)

tonymobile · Sun Dec 23, 2018 9:14 am

You are right that there could have been two ways to adjust the inaccurate setting for some users.
We chose to adjust towards compliance, not towards incompliance. If user has set a country, he possibly wanted to be compliant already.
I don't think that a user using superchannel with a country set wants to be compliant and I think the second option (changing country on update) is the best option.
In the end, these are things that should be written in changelog, I think lots of users lost CPE connection for this update.

I agree!

Probably mikrotik was the victim of some compliance check!

hapi · Sun Dec 23, 2018 10:37 am

hapi - Please provide supout file from your router that would be generated while router is inaccessible either over another interface or over serial console. We will see why you can not access router at some point. I do not see any reason why you should jump tp consclusions right away and announce this as a "bug".

viewtopic.php?f=3&t=142842&p=704812#p704812

genesispro · Sun Dec 23, 2018 11:40 am

"wireless - improvements in wireless frequency selection;"
Can you be more specific?
I think in the past it was only counting the count and not the quality of a frequency, now?

Redmor · Sun Dec 23, 2018 12:25 pm

You are right that there could have been two ways to adjust the inaccurate setting for some users.
We chose to adjust towards compliance, not towards incompliance. If user has set a country, he possibly wanted to be compliant already.
When will you understand that it is now impossible to conform?

Unfortunately, the 5 ghz band has collapsed, and we defend ourselves as we can.

You've probably been the victim of some compliance check!

You have to improve wireless performance absolutely, otherwise mikrotik will have a short life.

Take a look mimosa, cambium (I do not want to put ubiquiti in question)

I totally agree, except for Ubiquiti.
I tried AF5X for PTP where before I had Net Metal 5HP, it's another world. 200Mbps EFFECTIVE throughput with 50MHz channel in a really noisy environment, 16km link.

MikrotiTik you don't have to improve Nv2, to be competitive in the market you should make new antennas, something brutal and expensive, something though, I want to destroy trees with radio waves. 🤯
You really should see what competitors are doing and do it better, Net Metal is 5 years old.

oooscar · Sun Dec 23, 2018 12:58 pm

strods I'm not saying that this change is wrong, it should work like that, but:
1. Write it in changelog
2. If you have to update and set regulatory domain for countries, why removing superchannel with country set instead of unsetting country with superchannel set?

I don't think this change is correct. Why I cannot set a specific country and manual-txpower ? Country should filter frequencies on that country but I should be available to choose power as desired (regulatory that is really helpful but also manual).

I think to have flexibility is the best as we could do before.

And also agree that should be on changelog.

Sun Dec 23, 2018 1:06 pm

hapi - Please create a support ticket and lets continue this discussion there.
genesispro - After the fix, wireless configuration complies with allowed frequencies in your country based on "/interface wireless info country-info <country>".
Redmor - Please either contact support or create a new topic for this discussion. Lets keep this topic related to its subject - v6.43.8.
oooscar - This is not correct. Frequency is not an only thing that is limited by country regulations. See information under "/interface wireless info country-info <country>".

Redmor · Sun Dec 23, 2018 1:08 pm

strods I'm not saying that this change is wrong, it should work like that, but:
1. Write it in changelog
2. If you have to update and set regulatory domain for countries, why removing superchannel with country set instead of unsetting country with superchannel set?
I don't think this change is correct. Why I cannot set a specific country and manual-txpower ? Country should filter frequencies on that country but I should be available to choose power as desired (regulatory that is really helpful but also manual).

I think to have flexibility is the best as we could do before.

And also agree that should be on changelog.

I was mainly talking about superchannel but yes, I agree that at least with country we should be able to use manual tx power.

netwpl · Sun Dec 23, 2018 4:03 pm

still got DHCP Problems with some manufactors (eg. Samsung Galaxy S7).

The DHCP Server sits on the bridge interface (since ages!) but my Galaxy S7 cant get an IP address. After setting some static IP on the galaxy S7, everything works.

My DHCP Config:

/ip dhcp-server
add add-arp=yes address-pool=pool-lan always-broadcast=yes disabled=no \
    interface=bridge-local lease-time=1d name=dhcp-local
/ip dhcp-server network
add address=10.10.10.0/24 comment="default configuration" dns-server=\
    10.10.10.254 gateway=10.10.10.254 netmask=24 ntp-server=\
    10.10.10.254,10.2.0.1,10.99.0.1

Some DHCP debug output:

cheers

tonymobile · Sun Dec 23, 2018 5:43 pm

You are right that there could have been two ways to adjust the inaccurate setting for some users.
We chose to adjust towards compliance, not towards incompliance. If user has set a country, he possibly wanted to be compliant already.
When will you understand that it is now impossible to conform?

Unfortunately, the 5 ghz band has collapsed, and we defend ourselves as we can.

You've probably been the victim of some compliance check!

You have to improve wireless performance absolutely, otherwise mikrotik will have a short life.

Take a look mimosa, cambium (I do not want to put ubiquiti in question)
I totally agree, except for Ubiquiti.
I tried AF5X for PTP where before I had Net Metal 5HP, it's another world. 200Mbps EFFECTIVE throughput with 50MHz channel in a really noisy environment, 16km link.

MikrotiTik you don't have to improve Nv2, to be competitive in the market you should make new antennas, something brutal and expensive, something though, I want to destroy trees with radio waves. 🤯
You really should see what competitors are doing and do it better, Net Metal is 5 years old.

I Agree!!!

Really ubiquiti has reached these excellent levels? I did not know!!

I used ubiquiti, 6 years ago Nanostation 5 first version, then I have always been a follower of mikrotik.

I have more than 15000 routerboard switched on, in my region!!!!

Mikrotik is betraying generous and historic customers.

kikikakuku · Mon Dec 24, 2018 12:53 pm

You are right that there could have been two ways to adjust the inaccurate setting for some users.
We chose to adjust towards compliance, not towards incompliance. If user has set a country, he possibly wanted to be compliant already.

I've CPE scheduled to autoupgrade via scheduler script "/system package update download;" on all CPE's.
This update is just messing things up. After every autoupdate. Have to site visit every client just to change from regulatory to superchannel. What a pain.

If the frequency mode is set to superchannel why not just change the country to "no country" instead of switching to regulatory??? It's less troublesome as you don't lose connectivity.

Chupaka · Mon Dec 24, 2018 2:13 pm

why not just change the country to "no country" instead of switching to regulatory???

Let me guess... Because someone set 'country' value for some reason?

Caci99 · Mon Dec 24, 2018 3:18 pm

You are right that there could have been two ways to adjust the inaccurate setting for some users.
We chose to adjust towards compliance, not towards incompliance. If user has set a country, he possibly wanted to be compliant already.
I've CPE scheduled to autoupgrade via scheduler script "/system package update download;" on all CPE's.
This update is just messing things up. After every autoupdate. Have to site visit every client just to change from regulatory to superchannel. What a pain.

If the frequency mode is set to superchannel why not just change the country to "no country" instead of switching to regulatory??? It's less troublesome as you don't lose connectivity.

It has been widely advised since long to not update devices under production, instead do some lab updates beforehand and check the results. One of my customers was building a script to update devices automatically and I had a long talk to convince him otherwise.
It is just the way it is, updates should be tested in your particular environment, no matter how many checks Mikrotik (or other vendors) have done before the release.

anav · Mon Dec 24, 2018 3:35 pm

You are right that there could have been two ways to adjust the inaccurate setting for some users.
We chose to adjust towards compliance, not towards incompliance. If user has set a country, he possibly wanted to be compliant already.
I've CPE scheduled to autoupgrade via scheduler script "/system package update download;" on all CPE's.
This update is just messing things up. After every autoupdate. Have to site visit every client just to change from regulatory to superchannel. What a pain.

If the frequency mode is set to superchannel why not just change the country to "no country" instead of switching to regulatory??? It's less troublesome as you don't lose connectivity.
It has been widely advised since long to not update devices under production, instead do some lab updates beforehand and check the results. One of my customers was building a script to update devices automatically and I had a long talk to convince him otherwise.
It is just the way it is, updates should be tested in your particular environment, no matter how many checks Mikrotik (or other vendors) have done before the release.

Well stated, especially if one has customers. As for the wifi, if people are espousing using competitors products because the competitor products allow them to break the laws then fill your boots with illegal equipment and leave. I applaud Mikrotik for staying within the rules. There are reasons for following frequency regulations.

Redmor · Mon Dec 24, 2018 3:45 pm

You are right that there could have been two ways to adjust the inaccurate setting for some users.
We chose to adjust towards compliance, not towards incompliance. If user has set a country, he possibly wanted to be compliant already.
I've CPE scheduled to autoupgrade via scheduler script "/system package update download;" on all CPE's.
This update is just messing things up. After every autoupdate. Have to site visit every client just to change from regulatory to superchannel. What a pain.

If the frequency mode is set to superchannel why not just change the country to "no country" instead of switching to regulatory??? It's less troublesome as you don't lose connectivity.
It has been widely advised since long to not update devices under production, instead do some lab updates beforehand and check the results. One of my customers was building a script to update devices automatically and I had a long talk to convince him otherwise.
It is just the way it is, updates should be tested in your particular environment, no matter how many checks Mikrotik (or other vendors) have done before the release.
Well stated, especially if one has customers. As for the wifi, if people are espousing using competitors products because the competitor products allow them to break the laws then fill your boots with illegal equipment and leave. I applaud Mikrotik for staying within the rules. There are reasons for following frequency regulations.

There's still superchannel...

mkx · Mon Dec 24, 2018 4:15 pm

There's still superchannel...

I fully apreciate Mikrotik's commitment to deliver software that gives us users possibility to follow homeland's regulations. On the other hand I apreciate Mikrotik's willingness to give us users every possibility to break homeland's regulations.

I agree that it is the right way to make user fully aware when (s)he is breaking regulations. By not being able to break regulations when country is set to homeland, this principle is well served. Mikrotik makes possible to break rules if one wants to do it (I do it as well). It's just that we, the users, are responsible when doing it.

marekm · Mon Dec 24, 2018 4:34 pm

I've CPE scheduled to autoupgrade via scheduler script "/system package update download;" on all CPE's.
This update is just messing things up. After every autoupdate. Have to site visit every client just to change from regulatory to superchannel. What a pain.

If the frequency mode is set to superchannel why not just change the country to "no country" instead of switching to regulatory??? It's less troublesome as you don't lose connectivity.

Careful - documentation says no_country_set means FCC compliant channels (not all possible channels), so you may need to explicitly (no "default", just list of frequencies as numbers) set scan-list first, otherwise can lose connection (if current channel happens to not be FCC compliant).

CPEs are most affected by this issue, but they passively scan first, and transmit only after finding an (already non-compliant) AP broadcasting the configured SSID. So, suggestion to Mikrotik - if you really have to, make this change on upgrade only for APs (these are in much smaller numbers, and can be accessed over wired LAN to fix the config) and not for station modes.

tonymobile · Mon Dec 24, 2018 6:34 pm

why not just change the country to "no country" instead of switching to regulatory???
Let me guess... Because someone set 'country' value for some reason?

Of course, because as long as the rules were respected, many ISPs like me respected them, now that the collapse is now total, we had to defend in some way.

a life of sacrifice is in danger and 18 hours a day of work to carry on this business. I gave up everything, for example.

I thank Mikrotik for giving us the opportunity to circumvent the rules of the Country but now Mikrotik must cointinuate to make us work and survive in this jungle.

I may seem wordy but Mikrotik can not ignore it.

I feel betrayed, I have spent millions of euros on mikrotik devices.

Caci99 · Mon Dec 24, 2018 8:05 pm

why not just change the country to "no country" instead of switching to regulatory???
Let me guess... Because someone set 'country' value for some reason?
Of course, because as long as the rules were respected, many ISPs like me respected them, now that the collapse is now total, we had to defend in some way.

a life of sacrifice is in danger and 18 hours a day of work to carry on this business. I gave up everything, for example.

I thank Mikrotik for giving us the opportunity to circumvent the rules of the Country but now Mikrotik must cointinuate to make us work and survive in this jungle.

I may seem wordy but Mikrotik can not ignore it.

I feel betrayed, I have spent millions of euros on mikrotik devices.

They are still doing it and they are aware of practices around the world. That's why you have two set of rules, one to comply with regulation and one to choose no country option. How you use wireless devices is all up to you in regard to legal rules.
Mikrotik on its side needs to cover the legislation, otherwise they would not be able to export because of Custom Office and Frequency Authorities in countries over the world.
I haven't had any issue upgrading a couple of indoor AP which were set at no-country (by capsman) and are still at no-country option after upgrade, so I do not see the fuss about this new update.

oooscar · Tue Dec 25, 2018 11:26 am

strods I'm not saying that this change is wrong, it should work like that, but:
1. Write it in changelog
2. If you have to update and set regulatory domain for countries, why removing superchannel with country set instead of unsetting country with superchannel set?
I don't think this change is correct. Why I cannot set a specific country and manual-txpower ? Country should filter frequencies on that country but I should be available to choose power as desired (regulatory that is really helpful but also manual).

I think to have flexibility is the best as we could do before.

And also agree that should be on changelog.
I was mainly talking about superchannel but yes, I agree that at least with country we should be able to use manual tx power.

I hope to roll back the restriction of non beeing available to set a Country and use manual-txpower !
As most of us think this this is our choose.

Thanks,

Redmor · Tue Dec 25, 2018 11:46 am

strods I'm not saying that this change is wrong, it should work like that, but:
1. Write it in changelog
2. If you have to update and set regulatory domain for countries, why removing superchannel with country set instead of unsetting country with superchannel set?
I don't think this change is correct. Why I cannot set a specific country and manual-txpower ? Country should filter frequencies on that country but I should be available to choose power as desired (regulatory that is really helpful but also manual).

I think to have flexibility is the best as we could do before.

And also agree that should be on changelog.
I was mainly talking about superchannel but yes, I agree that at least with country we should be able to use manual tx power.

I hope to roll back the restriction of non beeing available to set a Country and use manual-txpower !
As most of us think this this is our choose.

Thanks,

If you don't want to have to wait 5 minutes to update use this:

Code: Select all


/system script

add name=update source="/system package update download; /interface wireless set 0 country=no_country_set; /system reboot\r\n"

Chupaka · Tue Dec 25, 2018 4:53 pm

s/set 0/set [find]/

Egert143 · Tue Dec 25, 2018 7:17 pm

Where can one find the new snmp values ?

"snmp - added "tx-ccq" ("mtxrWlStatTxCCQ") and "rx-ccq" ("mtxrWlStatRxCCQ") values;"

Its not listen under "interface wireless" or "interface wireless registration-tabel". Checked both Ap and Client with print oid.

Hotz1 · Tue Dec 25, 2018 10:34 pm

OSPF randomly passes only part of the records to the routing table. It stops having fun.

We're seeing this too. We have one building-to-building link, using dynamic-mesh WDS. The two buildings, and the WDS link, are all on distinct subnets, with routing managed by OSPF.

When the routers were running 6.43.4, when the link would drop & reestablish, everything recovered fine.

Since upgrading to 6.43.8 last night, when the link drops & reestablishes, the near end adds the correct routes to its routing table, but it doesn't seem to pass those updates to its other neighbors. Disabling and enabling the OSPF network for the WDS link corrects the problem almost immediately.

tonymobile · Wed Dec 26, 2018 12:13 pm

why not just change the country to "no country" instead of switching to regulatory???
Let me guess... Because someone set 'country' value for some reason?
Of course, because as long as the rules were respected, many ISPs like me respected them, now that the collapse is now total, we had to defend in some way.

a life of sacrifice is in danger and 18 hours a day of work to carry on this business. I gave up everything, for example.

I thank Mikrotik for giving us the opportunity to circumvent the rules of the Country but now Mikrotik must cointinuate to make us work and survive in this jungle.

I may seem wordy but Mikrotik can not ignore it.

I feel betrayed, I have spent millions of euros on mikrotik devices.
They are still doing it and they are aware of practices around the world. That's why you have two set of rules, one to comply with regulation and one to choose no country option. How you use wireless devices is all up to you in regard to legal rules.
Mikrotik on its side needs to cover the legislation, otherwise they would not be able to export because of Custom Office and Frequency Authorities in countries over the world.
I haven't had any issue upgrading a couple of indoor AP which were set at no-country (by capsman) and are still at no-country option after upgrade, so I do not see the fuss about this new update.

I know that without selection of the country everything works properly but I have been selecting the Country for many years.

Because as long as I could, I fully respected the rules, now it is impossible to continue to do so because the 5 GHz band is now dead.

With the old versions Mikrotik gave priority to the parameter superchannel now has changed direction.

He should have done it from the beginning, why did Mikrotik notice it just now?

I'm sorry, I do not agree with this choice, then all these years has been illegal outlaws ???

Rather, he committed himself to activating Spectral History again on AC devices.

Everyone has a software spectrum analyzer but obviously mikrotik no!

I am a TOP customer for Mikrotik and customers who spend a lot of money have to be heard.

I have been registered for many years on this forum, I have always been silent, without ever asking for help but this time I do not transpose!

MIKROTIK WAKE UP!

deanMKD1 · Wed Dec 26, 2018 2:30 pm

resource - fixed "total-memory" reporting on ARM devices;

What was fix fot this? Incorrectly show the memory? On what device?

mkx · Wed Dec 26, 2018 2:44 pm

resource - fixed "total-memory" reporting on ARM devices;
What was fix fot this? Incorrectly show the memory? On what device?

At least "original" hAP ac2 with 256MB total RAM used to show 240MB ... since latest beta it shows 256MB ... I'm not sure about free RAM though, I'd say it didn't increase (my unit shows 190MB free, my leaky memory says it was around that also before fix).

Hotz1 · Wed Dec 26, 2018 7:37 pm

...
kez - Sometimes router that was using "ac" did tend to reboot due to a Watchdog timer. This problem is now resolved. This does not mean that all "Watchdog reboots" are fixed in RouterOS. Usually such reboot happens on overloaded router.

We have a couple OmniTik ACs that have been rebooting every few days due to watchdog timeouts, since early November. They continue to do so, even after upgrading to 6.43.8.

One of the OmniTiks handles a lot of traffic; the other barely sees anything.

deanMKD1 · Wed Dec 26, 2018 10:36 pm

resource - fixed "total-memory" reporting on ARM devices;
What was fix fot this? Incorrectly show the memory? On what device?
At least "original" hAP ac2 with 256MB total RAM used to show 240MB ... since latest beta it shows 256MB ... I'm not sure about free RAM though, I'd say it didn't increase (my unit shows 190MB free, my leaky memory says it was around that also before fix).

Mine have 128MB RAM currently. Its from second batch with exact number of ram.

acron · Thu Dec 27, 2018 12:01 am

RouterBOARD 941-2nD, after upgrade from 6.43.6:
After fresh setup of L2TP/IPsec with pre-shared secret, clients cannot connect to VPN if pre-shared secret contains more than 4 characters :-/

Redmor · Thu Dec 27, 2018 1:39 am

RouterBOARD 941-2nD, after upgrade from 6.43.6:
After fresh setup of L2TP/IPsec with pre-shared secret, clients cannot connect to VPN if pre-shared secret contains more than 4 characters :-/

Please write OS of devices, I have a similar problem but only with Windows.

acron · Thu Dec 27, 2018 2:08 am

RouterBOARD 941-2nD, after upgrade from 6.43.6:
After fresh setup of L2TP/IPsec with pre-shared secret, clients cannot connect to VPN if pre-shared secret contains more than 4 characters :-/
Please write OS of devices, I have a similar problem but only with Windows.

I have two devices. The result is the same.
1. Windows 10 Pro version 1809 (OS build 17763.195)
2. Android 9 with security patch from 5. december 2018 (Xiaomi Mi A2 Lite, official ROM without any root/hacks)

BiRi · Thu Dec 27, 2018 11:24 am

After updating RouterOS to version 6.43.7, part,not all of computers in the LAN can't ping each other.Is there the problem with this version?

Thu Dec 27, 2018 12:08 pm

I see from this topic, that most people do not understand what "country" setting does, what "manual-tx-power" means and what is "superchannel" mode.
We will improve documentation on this topic, as I see there are a lot of misconceptions and wrong info in this thread.

In short, if you live in the EU and want to conform with the rules, you MUST use regulatory-domain and country name. It will enable DFS radar check and correct power output depending on chosen frequency.

If you have some special permission (!) to use other settings, select "no country set" and use "Superchannel" or manual-tx-power mode.

Others are free to use any setting you please, including manual-tx-power that allows to override powers, or superchannel, where you can set anything you want, or even choose a different country. Applied limitations you can check in "/interface wireless country-info germany" or any other country.

Egert143 · Thu Dec 27, 2018 12:18 pm

Hi Normis

Could you please clarify the snmp update, what is the new oid values for ccq? Could realy use them to monitor link quality.

Cha0s · Thu Dec 27, 2018 12:24 pm

Symbol: ` in WLAN SSID brake all wlan interfaces.
Or even not a symbol, but a virtual WLAN. When I create a virtual WLAN and reboot hap ac^2, I don't see all interfaces and export doesn't work in the console.

DimaFIX - Please send supout.rif file from your router to support@mikrotik.com. If I add such symbol to my wireless interfaces SSID, then it continue to work properly.

I don't think the problem is the ` symbol.
I upgraded over 40 devices of all makes and models without any problems.

But on a single hAP ac^2 after reboot the interface list was empty. The SSIDs were standard ASCII names, without any special character.
After many minutes of waiting, the interfaces appeared but the wlans were missing, and the whole board was very sluggish (no, there was no cpu load).
Reboots didn't help.

Also after each reboot a blue warning was shown about defconf not being able to find any wireless interfaces.

After downgrading back to 6.43.4, the warning is still there, reboot times are long, but all interfaces are working again.
I cannot troubleshoot this further since it's in production.

Thu Dec 27, 2018 1:35 pm

Where can one find the new snmp values ?

"snmp - added "tx-ccq" ("mtxrWlStatTxCCQ") and "rx-ccq" ("mtxrWlStatRxCCQ") values;"

Its not listen under "interface wireless" or "interface wireless registration-tabel". Checked both Ap and Client with print oid.

Thank you for reporting this, there is a bug regarding this value availability.

sff · Thu Dec 27, 2018 4:32 pm

GIANT HINT FOR EVERYONE EXPERIENCING 1GB TO 10GB PERFORMANCE ISSUES:

Throw out your 10Gb Mikrotik SFPs. Chuck them. The $159/ea Mikrotiks are the issue. I had a pair of FS.com brocade compatible 10GB 1310nm SFPs from another project. Swapped them in a link that was experiencing "wire speed" in one direction going 10Gb to 10Gb but only getting 650-750Mb in the other direction. This link was fine before upgrading the switch from a CRS226 to a CRS326.

But the FS.com parts? The 326 recognized it. Also plugged one into a 317 and it recognized it as well.

Performance issues are ALL GONE -- at least as far as 1Gb to 10Gb transition goes. The 326 now performs just as well as the 226 that was in there before. The issue is the SFPs. Period. End of story. DAYS WASTED finding this. And it wasn't just a single pair of SFPs. We've got dozens of 850nm and 1310nm 10Gb connections that are affected.

FYI: The FS.com 1310nm brocade compatible is $34. The 850nm is $16. I neither work for or am compensated in any way by FS.com for this "endorsement". BTW, an ACTUAL Brocade 10GB 850nm SFP is not recognized by the 317 or the 328 -- but the "Brocade compatible" is. Funny, eh?

Is it software? Did they really "improve" performance in 6.43.8? No idea. But if it is software, the issue is in talking to their own SFPs, not "compatible" generic modules.

I still love Mikrotik switches and routers. I am no longer a fan of their 10Gb SFPs.

pikpik · Thu Dec 27, 2018 4:37 pm

Waiting 30mins with status "detecting radar", wtf MT ?

complex1 · Thu Dec 27, 2018 5:43 pm

Please do a Google search and read (understand) why there is a 30-minute wait time when using the “DFS radar check”.

sff · Thu Dec 27, 2018 5:46 pm

strods - I posted today's message before seeing your comment from a couple of days ago. I would, however, disagree with what you said. The release notes for 6.43.8 specifically say that performance was improved, but it was not. So yes, this is a 6.43.8 "issue" as well as a general software/hardware issue.

I am certain that I can repeat the issue, across multiple switches and multiple SFPs. I can send data once I've got this onto a test network where I can play with it and send you files from a hardware configuration that fails as well as one that works. I can't do that from the ship's production network without getting lots of complaints from users.

I'll send an email to support once I have it repeating outside of a production environment.

erebusodora · Thu Dec 27, 2018 8:27 pm

There are no free frequencies. Mission Impossible to Pass on regulatory domain. It's time to go back to the old gold settings again country: south africa frequency mode=super channel to use 5400. 5440 etc.Association time is increased why ?.

socada · Fri Dec 28, 2018 6:49 am

I lost connection on some CPE´s and PTP´s my final solution is set to country: Debug - Frecuency: Superchannel.
I think Country Debug it´s equal or better than old no_country_set.

Regards.

Chupaka · Fri Dec 28, 2018 9:47 am

I think Country Debug it´s equal or better than old no_country_set.

> interface wireless info country-info no_country_set 
  ranges: 2402-2472/b,g,gn20,gn40(30dBm)
          2417-2457/g-turbo(20dBm)
          5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(17dBm)
          5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/dfs,passive
          5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(30dBm)
          5190-5230/a-turbo(17dBm)/dfs
          5230-5310/a-turbo(23dBm)/dfs,passive
          5740-5820/a-turbo(30dBm)/dfs
          5180-5260/a-turbo(17dBm)
          5260-5300/a-turbo(23dBm)/dfs,passive
          5745-5825/a-turbo(30dBm)
          902-927/b,g,g-turbo,gn20,gn40(30dBm)

> interface wireless info country-info debug          
  ranges: 902-927/b,g,g-turbo,gn20,gn40(5dBm)
          2302-2382/b,g,gn20,gn40(5dBm)
          2402-2482/b,g,gn20,gn40(5dBm)
          2474-2494/b,g,gn20,gn40(5dBm)
          2502-2742/b,g,gn20,gn40(5dBm)
          2292-2392/g-turbo(5dBm)
          2417-2457/g-turbo(5dBm)
          2492-2752/g-turbo(5dBm)
          5110-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(5dBm)
          5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(5dBm)
          5110-5690/a-turbo(5dBm)
          5130-5670/a-turbo(5dBm)

Debug has very low power limits - 5 dBm (like 3mW)

socada · Fri Dec 28, 2018 10:17 am

I think Country Debug it´s equal or better than old no_country_set.

> interface wireless info country-info no_country_set 
  ranges: 2402-2472/b,g,gn20,gn40(30dBm)
          2417-2457/g-turbo(20dBm)
          5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(17dBm)
          5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/dfs,passive
          5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(30dBm)
          5190-5230/a-turbo(17dBm)/dfs
          5230-5310/a-turbo(23dBm)/dfs,passive
          5740-5820/a-turbo(30dBm)/dfs
          5180-5260/a-turbo(17dBm)
          5260-5300/a-turbo(23dBm)/dfs,passive
          5745-5825/a-turbo(30dBm)
          902-927/b,g,g-turbo,gn20,gn40(30dBm)

> interface wireless info country-info debug          
  ranges: 902-927/b,g,g-turbo,gn20,gn40(5dBm)
          2302-2382/b,g,gn20,gn40(5dBm)
          2402-2482/b,g,gn20,gn40(5dBm)
          2474-2494/b,g,gn20,gn40(5dBm)
          2502-2742/b,g,gn20,gn40(5dBm)
          2292-2392/g-turbo(5dBm)
          2417-2457/g-turbo(5dBm)
          2492-2752/g-turbo(5dBm)
          5110-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(5dBm)
          5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(5dBm)
          5110-5690/a-turbo(5dBm)
          5130-5670/a-turbo(5dBm)

Debug has very low power limits - 5 dBm (like 3mW)

This power limits it´s if you put regulatory-domain, in normal cases if put debug you use superchannel. I check this in my antennas, put debug and superchannel and works same power than no_country_set. But if put debug and regulatory-domain drops the power to this 5dbm.

Chaosphere64 · Fri Dec 28, 2018 12:24 pm

In short, if you live in the EU and want to conform with the rules, you MUST use regulatory-domain and country name. It will enable DFS radar check and correct power output depending on chosen frequency.

If you have some special permission (!) to use other settings, select "no country set" and use "Superchannel" or manual-tx-power mode.

What about the use of CAPsMAN? AFAIK the default setting for the frequency-mode setting is "manual-tx-power". One can't configure that setting when using CAPsMAN while you can configure a country. Does solely setting the country variable conform with the EU rules as long as you don't manipulate the tx power?

Fri Dec 28, 2018 4:35 pm

In short, if you live in the EU and want to conform with the rules, you MUST use regulatory-domain and country name. It will enable DFS radar check and correct power output depending on chosen frequency.

If you have some special permission (!) to use other settings, select "no country set" and use "Superchannel" or manual-tx-power mode.
What about the use of CAPsMAN? AFAIK the default setting for the frequency-mode setting is "manual-tx-power". One can't configure that setting when using CAPsMAN while you can configure a country. Does solely setting the country variable conform with the EU rules as long as you don't manipulate the tx power?

For CAPsMAN the value is "regulatory-domain"

voytec · Fri Dec 28, 2018 6:09 pm

The problem occurred after upgrading CCR1009-8G-1S-1S+ to 6.43.8.

I lost the ability to write and delete files in the NAND Flash memory. Free space is 55% from 128MB
Any operation related to writing, deleting, restoring settings ends with the information with the note "action failed (6)", e.g.
Couldn't remove File <abcd.txt> - action failed (6)
Couldn't restore configuration - action failed (6)

The first symptom is the lack of logging in. User settings were restored to default (admin / no password).
After setting a password and even creating a new user, the changes will disappear after some time.

I tried to restore the default settings with the "Reset" button and I lost the configuration, but I still can't write to the NAND memory.

Is there any way to restore the possibility of writing to NAND memory.

whatever · Fri Dec 28, 2018 10:16 pm

*) capsman - fixed "group-key-update" parameter not using correct units;

Can we get some details on this?
How was the parameter interpreted before this fix? Is the long-term release affected by the same bug? If yes: when can we expect a backport of this bugfix to long-term?

erebusodora · Sat Dec 29, 2018 12:42 pm

After upgrade from 6.38.5 to 6.43.8 board 911G-5HPacD link 8 km the result is:

6.38.5
ping -3 ms
bandwidth test TCP: - 210 mbps

6.43.8
ping- 6 ms
bandwidth test TCP: - 145 mbps

I'm disappointed after upgrade. The only reason I made the change was that I saw in changelog: *) wireless - improved stability for 802.11ac;

cwade · Sat Dec 29, 2018 5:13 pm

OSPF randomly passes only part of the records to the routing table. It stops having fun.
We're seeing this too. We have one building-to-building link, using dynamic-mesh WDS. The two buildings, and the WDS link, are all on distinct subnets, with routing managed by OSPF.

When the routers were running 6.43.4, when the link would drop & reestablish, everything recovered fine.

Since upgrading to 6.43.8 last night, when the link drops & reestablishes, the near end adds the correct routes to its routing table, but it doesn't seem to pass those updates to its other neighbors. Disabling and enabling the OSPF network for the WDS link corrects the problem almost immediately.

These comments are interesting to us, since we encountered odd OSPF update problems after upgrading from 6.43.4 to 6.43.7. However, in our case, the network context is very complex, with two separately-managed networks peering via OSPF. We are actually deploying MikroTik routers to isolate the routing between these two networks. Since we only have control over one of the two networks, it is difficult for us to diagnose the problem when we are looking at OSPF issues on the boundary between the two networks.

My purpose in adding to these comments is to see if anyone else has encountered problems with OSPF route updates after upgrading to 6.43.7 or 6.43.8. The 6.43.7 release notes include:

*) ospf - improved stability while handling type-5 LSAs;

However, OSPF is not mentioned in the 6.43.8 release notes. One reason we upgraded to 6.43.7 was due to the above release note. I will try to provide more information, but our current situation is too complex to allow easy analysis. I’m intrigued with the simpler network setup describe by Hotz1, and may try to configure something similiar in a lab context to attempt to diagnose matters further.

orestis · Sat Dec 29, 2018 6:52 pm

After upgrading a couple of days ago to 6.43.8 stable in my RB952Ui-5ac2nD, i have experienced continuous reboots due to watchdog timer when i was casting from my laptop's chrome to google's chromecast (ver 2) using wifi 5G. I don't have the same issues while performing the same tasks in another 2.4G chromecast (ver 1). I will apply an ACL for chromecast (ver 2) in 5G and force thus only 2.4G wifi and see if it occurs again. I did't had such issues in the past while casting to any of them and for any type of supported casting (youtube, netflix, android apps, chromecast/opera content etc) in both 2.4G/5G.

socada · Sat Dec 29, 2018 9:53 pm

After upgrade from 6.38.5 to 6.43.8 board 911G-5HPacD link 8 km the result is:

6.38.5
ping -3 ms
bandwidth test TCP: - 210 mbps

6.43.8
ping- 6 ms
bandwidth test TCP: - 145 mbps

I'm disappointed after upgrade. The only reason I made the change was that I saw in changelog: *) wireless - improved stability for 802.11ac;

In my PTP i don´t see changes, equal ping and equal bandwidth.
The only problem is the change of frecuency mode, i finnaly put all in debug and superchannel.
All of my antennas is dynadish 5 and NetMetal 5SHP with mAnt 30.

nichky · Sat Dec 29, 2018 10:44 pm

I think Country Debug it´s equal or better than old no_country_set.

> interface wireless info country-info no_country_set 
  ranges: 2402-2472/b,g,gn20,gn40(30dBm)
          2417-2457/g-turbo(20dBm)
          5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(17dBm)
          5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/dfs,passive
          5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(30dBm)
          5190-5230/a-turbo(17dBm)/dfs
          5230-5310/a-turbo(23dBm)/dfs,passive
          5740-5820/a-turbo(30dBm)/dfs
          5180-5260/a-turbo(17dBm)
          5260-5300/a-turbo(23dBm)/dfs,passive
          5745-5825/a-turbo(30dBm)
          902-927/b,g,g-turbo,gn20,gn40(30dBm)

> interface wireless info country-info debug          
  ranges: 902-927/b,g,g-turbo,gn20,gn40(5dBm)
          2302-2382/b,g,gn20,gn40(5dBm)
          2402-2482/b,g,gn20,gn40(5dBm)
          2474-2494/b,g,gn20,gn40(5dBm)
          2502-2742/b,g,gn20,gn40(5dBm)
          2292-2392/g-turbo(5dBm)
          2417-2457/g-turbo(5dBm)
          2492-2752/g-turbo(5dBm)
          5110-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(5dBm)
          5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(5dBm)
          5110-5690/a-turbo(5dBm)
          5130-5670/a-turbo(5dBm)

Debug has very low power limits - 5 dBm (like 3mW)

This power limits it´s if you put regulatory-domain, in normal cases if put debug you use superchannel. I check this in my antennas, put debug and superchannel and works same power than no_country_set. But if put debug and regulatory-domain drops the power to this 5dbm.

Sorry socada just quick question i'm willing to know.
How you puting debug for regulatory-domain and superchannel ?

Cha0s · Sun Dec 30, 2018 12:21 am

Symbol: ` in WLAN SSID brake all wlan interfaces.
Or even not a symbol, but a virtual WLAN. When I create a virtual WLAN and reboot hap ac^2, I don't see all interfaces and export doesn't work in the console.

DimaFIX - Please send supout.rif file from your router to support@mikrotik.com. If I add such symbol to my wireless interfaces SSID, then it continue to work properly.
I don't think the problem is the ` symbol.
I upgraded over 40 devices of all makes and models without any problems.

But on a single hAP ac^2 after reboot the interface list was empty. The SSIDs were standard ASCII names, without any special character.
After many minutes of waiting, the interfaces appeared but the wlans were missing, and the whole board was very sluggish (no, there was no cpu load).
Reboots didn't help.

Also after each reboot a blue warning was shown about defconf not being able to find any wireless interfaces.

After downgrading back to 6.43.4, the warning is still there, reboot times are long, but all interfaces are working again.
I cannot troubleshoot this further since it's in production.

Upon further testing on this, the culprit is indeed the virtual wlan interfaces.

The issue seems to be present on older versions as well but not that severe.

With versions 6.42.10, 6.34.4, 6.34.7 that I tried doing a clean netinstall on all of them, after a reboot, the router would become reachable via IP after 20-30 seconds after actually booting. In the meantime accessing the router via MAC, the interface list is empty, all IP addresses show 'unknown' interface and no traffic passes through. After 20-30 seconds, all interfaces appear and the router start routing traffic.

Upgrading to 6.34.8, the issue is much more severe. It took over 25 minutes for the interfaces to finally appear. In the first 5 minutes the ethernet, pppoe, l2tp, eoip, bridge interfaces show up - but no traffic was routed. After 25-30 minutes the wlan interfaces appear as well, and only then traffic starts to flow through.

Disabling the virtual wlan interfaces, did not solve the issue. They had to completely get deleted. After that the router boots up in mere seconds and starts routing traffic immediately.

So, it appears there's an issue with virtual wlans on hAP ac^2 (or ARM - I don't have another ARM based device with wlans to confirm).

Cha0s · Sun Dec 30, 2018 12:23 am

Just to clarify (if anyone else wants/can reproduce this), the config regarding the virtual wlan interfaces was, 1 virtual wlan interface per physical wlan (one for 2.4GHz and one for 5GHz) both added to a bridge.

socada · Sun Dec 30, 2018 12:35 am

I think Country Debug it´s equal or better than old no_country_set.
Code: Select all
> interface wireless info country-info no_country_set 
  ranges: 2402-2472/b,g,gn20,gn40(30dBm)
          2417-2457/g-turbo(20dBm)
          5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(17dBm)
          5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/dfs,passive
          5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(30dBm)
          5190-5230/a-turbo(17dBm)/dfs
          5230-5310/a-turbo(23dBm)/dfs,passive
          5740-5820/a-turbo(30dBm)/dfs
          5180-5260/a-turbo(17dBm)
          5260-5300/a-turbo(23dBm)/dfs,passive
          5745-5825/a-turbo(30dBm)
          902-927/b,g,g-turbo,gn20,gn40(30dBm)
Code: Select all
> interface wireless info country-info debug          
  ranges: 902-927/b,g,g-turbo,gn20,gn40(5dBm)
          2302-2382/b,g,gn20,gn40(5dBm)
          2402-2482/b,g,gn20,gn40(5dBm)
          2474-2494/b,g,gn20,gn40(5dBm)
          2502-2742/b,g,gn20,gn40(5dBm)
          2292-2392/g-turbo(5dBm)
          2417-2457/g-turbo(5dBm)
          2492-2752/g-turbo(5dBm)
          5110-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(5dBm)
          5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(5dBm)
          5110-5690/a-turbo(5dBm)
          5130-5670/a-turbo(5dBm)
Debug has very low power limits - 5 dBm (like 3mW)
This power limits it´s if you put regulatory-domain, in normal cases if put debug you use superchannel. I check this in my antennas, put debug and superchannel and works same power than no_country_set. But if put debug and regulatory-domain drops the power to this 5dbm.
Sorry socada just quick question i'm willing to know.
How you puting debug for regulatory-domain and superchannel ?

No, I put debug for country and superchannel for frequency mode. In this answer I say that the power in the middle of () is only if you put regulatory-domain but if you put superchannel the power is the maximum.
Sorry if I don't understand your question my English not very good.

nichky · Sun Dec 30, 2018 12:57 am

I think Country Debug it´s equal or better than old no_country_set.
Code: Select all
> interface wireless info country-info no_country_set 
  ranges: 2402-2472/b,g,gn20,gn40(30dBm)
          2417-2457/g-turbo(20dBm)
          5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(17dBm)
          5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/dfs,passive
          5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(30dBm)
          5190-5230/a-turbo(17dBm)/dfs
          5230-5310/a-turbo(23dBm)/dfs,passive
          5740-5820/a-turbo(30dBm)/dfs
          5180-5260/a-turbo(17dBm)
          5260-5300/a-turbo(23dBm)/dfs,passive
          5745-5825/a-turbo(30dBm)
          902-927/b,g,g-turbo,gn20,gn40(30dBm)
Code: Select all
> interface wireless info country-info debug          
  ranges: 902-927/b,g,g-turbo,gn20,gn40(5dBm)
          2302-2382/b,g,gn20,gn40(5dBm)
          2402-2482/b,g,gn20,gn40(5dBm)
          2474-2494/b,g,gn20,gn40(5dBm)
          2502-2742/b,g,gn20,gn40(5dBm)
          2292-2392/g-turbo(5dBm)
          2417-2457/g-turbo(5dBm)
          2492-2752/g-turbo(5dBm)
          5110-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(5dBm)
          5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(5dBm)
          5110-5690/a-turbo(5dBm)
          5130-5670/a-turbo(5dBm)
Debug has very low power limits - 5 dBm (like 3mW)
This power limits it´s if you put regulatory-domain, in normal cases if put debug you use superchannel. I check this in my antennas, put debug and superchannel and works same power than no_country_set. But if put debug and regulatory-domain drops the power to this 5dbm.
Sorry socada just quick question i'm willing to know.
How you puting debug for regulatory-domain and superchannel ?
No, I put debug for country and superchannel for frequency mode. In this answer I say that the power in the middle of () is only if you put regulatory-domain but if you put superchannel the power is the maximum.
Sorry if I don't understand your question my English not very good.

You dont need excellent english, just simple like you said:

"This power limits it´s if you put regulatory-domain, in normal cases if put debug you use superchannel. I check this in my antennas, put debug and superchannel and works same power than no_country_set. But if put debug and regulatory-domain drops the power to this 5dbm"

My quastion was HOW??

How you puting debug for regulatory-domain and superchannel ?

Jotne · Sun Dec 30, 2018 9:08 am

My quastion was HOW??

Quote only what is needed. No need to quote a quoted a quoted post.....
To reply to a post above you, click Post Reply below the post, not the " above the post.

socada · Sun Dec 30, 2018 11:52 am

You dont need excellent english, just simple like you said:

"This power limits it´s if you put regulatory-domain, in normal cases if put debug you use superchannel. I check this in my antennas, put debug and superchannel and works same power than no_country_set. But if put debug and regulatory-domain drops the power to this 5dbm"

My quastion was HOW??

How you puting debug for regulatory-domain and superchannel ?

I´m not saying that I use both at same time (superchannel and regulatory domain) only one need to choose obviously.
I think we are not understanding but I repeat that I have done and it working, I said that I put country in debug and another user said that this country works at low power (5dbm).

> interface wireless info country-info debug
ranges: 902-927/b,g,g-turbo,gn20,gn40(5dBm)
2302-2382/b,g,gn20,gn40(5dBm)
2402-2482/b,g,gn20,gn40(5dBm)
2474-2494/b,g,gn20,gn40(5dBm)
2502-2742/b,g,gn20,gn40(5dBm)
2292-2392/g-turbo(5dBm)
2417-2457/g-turbo(5dBm)
2492-2752/g-turbo(5dBm)
5110-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(5dBm)
5735-5835/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(5dBm)
5110-5690/a-turbo(5dBm)
5130-5670/a-turbo(5dBm)
Debug has very low power limits - 5 dBm (like 3mW)

But I try and saw that this power (5dbm) it´s only when put debug for country and regulatory-domain for frecuency mode.
In summary I have my devices in debug and superchannel and I can reach the full power of transmit of device and more variety of channels in default-scan-list that in no_country_set then if I want to follow regulation of my country or not it´s in my hand.

sjoukes · Sun Dec 30, 2018 5:23 pm

*) capsman - fixed "group-key-update" parameter not using correct units;
Can we get some details on this?
How was the parameter interpreted before this fix? Is the long-term release affected by the same bug? If yes: when can we expect a backport of this bugfix to long-term?

I've been debugging this and comparing the Group Key Handshake (GTK update) between 6.43.7 and 6.43.8 during the weekend, since I have a lot of clients with the famous group-key timeout issue.
I came to the following conclusion: if you set the group-key-update timer to 1:00:00 (1 Hour) on versions 6.43.7 and older the group-key is updated every 36 seconds instead of 3600 ( I believe the minimum interval should be 5 minutes (300 seconds)).
After you apply the 6.43.8 update the Group Key Handshake is performed every 3600 seconds just like configured. I did not test any value lower than 1 hour, so I don't know what it did when set to 30 minutes or 5 minutes.
The GTK is shared on establishing a new connection to a Wi-Fi ap during the WPA(2) 4 way handshake. After that it is updated every configured interval with an advised minimum of 300 seconds via a 2 way handshake. You can imagen what happens when a client misses this update and is unable to communicate (unicast/multicast) after it expired. I did not fully read the 802.11 spec. I believe an expired key can be used up to 60 seconds after it expired after that a client needs to re-establish its connection, probably by performing a full 4 way handshake effectively losing its Wi-Fi connection.
Long story short, the Group Key Update feature is working now like it should and did not work before as expected and was probably causing a lot of issues on busy networks or on devices in battery save mode since it had a a lot of opportunities for missing an update of the GTK..

whatever · Mon Dec 31, 2018 12:08 am

Thank you for that info, it's rather interesting that wifi is still usable with 36 sec update interval.
I really hope that the fix gets backported to long-term soon.

R1CH · Mon Dec 31, 2018 4:36 pm

!) telnet - do not allow to set "tracefile" parameter;

After some digging, it turns out this is actually to fix an exploit that enables privilege escalation to root or damage to system files. Why is this not labelled as a security fix?

https://cxsecurity.com/issue/WLB-2018120151

DimaFIX · Mon Dec 31, 2018 9:16 pm

But on a single hAP ac^2 after reboot the interface list was empty.

Disable /tool graphing, and use 6.43.8.

Cha0s · Mon Dec 31, 2018 9:25 pm

Thanks! That resolved the issue!

r00t · Mon Dec 31, 2018 9:59 pm

!) telnet - do not allow to set "tracefile" parameter;
After some digging, it turns out this is actually to fix an exploit that enables privilege escalation to root or damage to system files. Why is this not labelled as a security fix?

https://cxsecurity.com/issue/WLB-2018120151

Nice find.

whatever · Tue Jan 01, 2019 12:35 pm

https://cxsecurity.com/issue/WLB-2018120151

Wow. Does every process in routeros run with unrestricted root privileges?

mkx · Tue Jan 01, 2019 12:45 pm

https://cxsecurity.com/issue/WLB-2018120151
Wow. Does every process in routeros run with unrestricted root privileges?

Many processes used to run with unrestricted root privileges in linux 15 years ago but not anymore. I guess many similar problems will be fixed in ROS7 ...

Chaosphere64 · Tue Jan 01, 2019 11:51 pm

Strange. Isn't a torch via winbox and via webfig supposed to deliver the same results? Because I just noticed that it does not. Torch via webfig just shows two lines (see screenshot Torch2). Device is hEX S, ROS is 6.43.8, same interface, roughly the same time.

Torch2.png

Torch1.png

Wed Jan 02, 2019 12:14 am

roughly the same time.

I guess this likely is the point. Torch is a "right now" tool, not a "historical data" tool.

rushlife · Wed Jan 02, 2019 10:22 am

after upgrade from v6.43.7 to v6.43.8 I am unable to have USB APPLE ethernet adapter, in /system/serources/usb
I see vendor Apple, Name : Apple USB Ethernet Adapter, even serial nuber is visible but interface "Ether2" is missing and all firewall rules for that interface are RED...

Chaosphere64 · Wed Jan 02, 2019 12:05 pm

roughly the same time.
I guess this likely is the point. Torch is a "right now" tool, not a "historical data" tool.

I get that. But the webfig torch NEVER shows more than the two lines to be seen in the screenshot, no matter what traffic is to be seen via winbox.

Wed Jan 02, 2019 12:53 pm

I get that. But the webfig torch NEVER shows more than the two lines to be seen in the screenshot, no matter what traffic is to be seen via winbox.

Just tried it myself. Right after opening the Torch screen I can see the same two lines as shown on your screenshots, but after clicking on the "Start" button it works as expected. Weird behavior, indeed.

Chaosphere64 · Wed Jan 02, 2019 4:57 pm

I get that. But the webfig torch NEVER shows more than the two lines to be seen in the screenshot, no matter what traffic is to be seen via winbox.
Just tried it myself. Right after opening the Torch screen I can see the same two lines as shown on your screenshots, but after clicking on the "Start" button it works as expected. Weird behavior, indeed.

Thanks for reviewing my observation. Also in my case pressing the "Start" button helps, but I suppose it's not the way it's meant to be.

sjoukes · Wed Jan 02, 2019 5:59 pm

I've update a couple (±30) of RB2011/RB3011's hAP AC^2's and wAP AC devices from 6.43.4 to 6.43.8 and until now I got 2 wAP AC devices in an undefined state right after/during the update (update via capsman), they would not boot anymore. Luckily I'm able to power cycle these devices via PoE switches. After the powercycle the devices start with normal behaviour and the routerboard firmware has been updated to 6.34.8 (Routerboard firmware is set to auto update). It seems that they are able to updaten but fail to fully boot after the update, after a forced reboot (via PoE power cycle) the devices become responsive again and work as expected. The log of both the router and the AP show no warnings during/after the update.

A9691 · Thu Jan 03, 2019 1:29 pm

The following code fails all the time:

/system script environment> :global A 10; remove "A"; :global A 20; print; remove "A"
 # NAME               VALUE                                                                            
 0 A                  20                                                                               
no such item (4)

The error message is produced by the last remove command.

This is basically the same, but usually works, if not repeated right away:

/system script environment> :global A 10; remove "A"; :global A 20; print; :delay 5; remove "A"

I guess there is no guarantee that 5 second delay is always enough.

(RB951G-2HnD, ros v6.43.8 )

mrz · Thu Jan 03, 2019 1:37 pm

There will always be delays before items appear in the table. Slower CPU greater delay.

A9691 · Thu Jan 03, 2019 2:03 pm

There will always be delays before items appear in the table. Slower CPU greater delay.

There is no delay in appearance. The print command finds the entry named A, but the remove command fails regardless.

eworm · Thu Jan 03, 2019 2:31 pm

This works:

/system script environment { :global A 10; remove "A"; :global A 20; print; remove [ find where name="A" ]; }

I do not have an explanation, though.

mrz · Thu Jan 03, 2019 2:34 pm

remove [find name="A"]

but I would suggest to use proper method and unset variables
:set A

If you have any further questions post in correct section, this is not v6.43.8 related.

erebusodora · Fri Jan 04, 2019 8:44 am

After upgrade from 6.38.5 to 6.43.8 error: DHCP server offering lease without success. With version 6.38.5 working but allversion sfter 6.38.5 not working DHCP

pranoy1083 · Fri Jan 04, 2019 1:02 pm

Hello Friends...
I am using CCR1016-12G (tile) for my office network management. Yesterday i upgraded the OS version to 6.43.8 from v6.39. After upgrading, i make some queue is simple queue but it's not working. Upload & Download both are showing 0bps. Previously made queues are working finely. Last queue i added as below.

name="youtube-pranoy" target=10.3.10.180/32 parent=none packet-marks=BDCOM_Youtube priority=8/8 queue=default-small/default-small limit-at=2M/2M max-limit=2M/2M burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s bucket-size=0.1/0.1

Please suggest me what should i do now? All users are using unlimited bandwidth now, thats why, it's so much tough to me for managing the bandwidth.
Another thing is that, when i logged into the mikrotik via winbox, it's showing unsecured mode at the right corner.

mkx · Fri Jan 04, 2019 2:43 pm

Is perhaps fasttrack active (you'll see it in /ip firewall filter)? fasttrack-ing is not compatible with queues.

pranoy1083 · Sat Jan 05, 2019 1:56 am

Is perhaps fasttrack active (you'll see it in /ip firewall filter)? fasttrack-ing is not compatible with queues.

I didn't find any fasttrack filter in firewall. This issue is happening with those queues which are created later. Previously made queues are ok.

Sat Jan 05, 2019 12:53 pm

pranoy1083, the problem is likely in the queues themselves and not specific to this particular version. Please start a new topic for this and/or (better yet) report it to support@.

mducharme · Sat Jan 05, 2019 10:20 pm

Please suggest me what should i do now? All users are using unlimited bandwidth now, thats why, it's so much tough to me for managing the bandwidth.
Another thing is that, when i logged into the mikrotik via winbox, it's showing unsecured mode at the right corner.

Potentially the problem is with queue 216? The target there is 0.0.0.0/0 and might be preventing the traffic from going to later queues.

CZFan · Wed Jan 09, 2019 1:02 am

Not sure if mentioned in this thread / topic yet, but upgraded CHR with Dude running couple of days ago. Tonight I had to do some maintenance on network equipment and but could not disable notifications in the Dude.

Untick all in notifications, click apply, then OK. as soon as I bounced the first network device, I got hammered with Dude notifications, checked the Dude and notifications did not disable.

sid5632 · Wed Jan 09, 2019 3:06 am

Dude is full of annoying bugs like this. Try changing notification settings from Winbox instead of Dude client.

Jzatan · Wed Jan 09, 2019 10:11 am

Im using CRS112-8p-4S poe switch, with 6.43.8 version, and i have noticed the following bug.

Example, i have trunk(tagged) interface - ether 8, with some vlans (example. 200,300,400), and access ports(untagged) - ether1,ether2 is vlan200. Ether3, ether4 is vlan's 300, etc.

I have noticed, when I connect my Raspberry Pi 3 B+ to ether3, which goes thru vlan300, I can't access my DHCP server, which should give me some IP address, for example 10.10.30.x, instead, i get the 169.254.x.x/16 address. However, when I set Poe-out:OFF on ether3, my Raspberry gets through and gets the 10.10.30.x IP address.

P.S.
My Raspberry does not support PoE In.

EvgenyK · Wed Jan 09, 2019 2:51 pm

Bug !
CRL downloading/updating is broken. I had to turn off the CRL check after upgrade.
Please check it.

GreatForcez · Mon Jan 14, 2019 3:52 pm

Bug with TikApp recognition:
The TikApp is recognized as Winbox since the latest updates, therefore disabling the TikApp in the /user group menu won't block the app anymore.
If Winbox is enabled in the group permission, anyone with the TikApp can login.
Tested on an RB951 testrouter and Samsung Galaxy S6.

Tue Jan 15, 2019 11:38 pm

I've update a couple (±30) of RB2011/RB3011's hAP AC^2's and wAP AC devices from 6.43.4 to 6.43.8 and until now I got 2 wAP AC devices in an undefined state right after/during the update (update via capsman), they would not boot anymore. Luckily I'm able to power cycle these devices via PoE switches. After the powercycle the devices start with normal behaviour and the routerboard firmware has been updated to 6.34.8 (Routerboard firmware is set to auto update). It seems that they are able to updaten but fail to fully boot after the update, after a forced reboot (via PoE power cycle) the devices become responsive again and work as expected. The log of both the router and the AP show no warnings during/after the update.

I see similar behavior. When manually upgraded ros to this version, I suddenly realised that routerboot was also upgraded, even the (undocumented!) feature system/routerboard/settings/"auto-upgrade" is not set. At least all devices booted normally (and only once) after upgrade so far.

Campano · Thu Jan 17, 2019 2:55 pm

hello support!
Could you give us more information about this changelog entry?

*) wireless - improved stability for 802.11ac;

What have been changed? Any improvement in NV2?

Thanks!
Would like to know as well. My RB4011 keeps disabling 5ghz WiFi after a few days (see graph). Only a reboot can bring the WiFi up again. Wondering if this has been fixed

That is the exact same problem 4 me

Etz · Tue Jan 22, 2019 11:36 pm

Found possible bug:

When you add subnet into "available from" field for SSH service, under IP Services...SSH becomes inaccessible, even if PC is in that subnet.

ssh_exchange_identification: Connection closed by remote host

It seems only to affect SSH though, for limiting access to http, https it work just fine.

Muator · Thu Jan 24, 2019 10:40 am

Подскажите пожалуйста, почему удален мой пост о проблеме MTU при создании влан на интерфейсе bonding ?
Проверял на ROS архитекуры x86, проблема актуальна.

____________________________________________________

Please tell me why my post about the MTU problem was deleted when creating a vlan on the bonding interface?
Checked x86 on ROS 6.43.8, the problem is urgent.

Thu Jan 24, 2019 12:07 pm

Mutator, in a previous post you wrote yourself that the problem is also reproducible on an earlier versions of RouterOS (6.42.x), so it is NOT a 6.43.8 specific regression. The release topics are meant for version-specific issues only.

Also you have already reported the problem in another thread, and there's absolutely no need to flood the forum with the same report in different places.

And also your previous post was in Russian only. This is an International forum, please respect others and post here in English only. Thanks in advance.

Muator · Thu Jan 24, 2019 1:07 pm

Mutator, in a previous post you wrote yourself that the problem is also reproducible on an earlier versions of RouterOS (6.42.x), so it is NOT a 6.43.8 specific regression. The release topics are meant for version-specific issues only.

In the currently supported stable and longterm versions, this problem exists, so it needs to be fixed.
Gentlemen from Mikrotik does not support outdated ROS branches? Stable 6.43.8. Right ?
Also in the neighboring branches, users point to a similar problem bonding, on ROS versions, of ROS that are no longer supported.
Experts mikrotik, ignored, all these posts, which indicate problems mtu and l2mtu, platform x86.
He pointed out that this problem also affects another branch.
So I now indicate in each branch that there is this problem?

_____________________________________________________________________________________________

В поддерживаемой актуальной stable и longterm версиях, эта проблема существует, поэтому ее необходимо исправить.
Господа из Микротик не поддерживает устаревшие ветки ROS ? Кроме стабильной 6.43.8. Верно ?
Так же в соседних ветках, пользователи указывают на аналогичную проблему с bonding, на ROS уже не поддерживаемых версиях ROS.
Специалисты mikrotik, проигнорировали, все эти посты, в которых указывают на проблемы mtu and l2mtu, платформы x86.
Указал, что эта проблема так же затрагивает и другую ветку.
Так что мне в каждой ветке теперь указать, что есть эта проблема ?

And also your previous post was in Russian only. This is an International forum, please respect others and post here in English only. Thanks in advance.

ok, fix it.

Chupaka · Thu Jan 24, 2019 2:36 pm

So I now indicate in each branch that there is this problem?

_____________________________________________________________________________________________

Так что мне в каждой ветке теперь указать, что есть эта проблема ?

Nope, problems must be reported to support@mikrotik.com. This is community forum, if problem cannot be solved by changing your config - we can only sympathize. Or recommend to write to support@

Muator · Thu Jan 24, 2019 2:47 pm

Nope, problems must be reported to support@mikrotik.com.

This is done, waiting for an answer.

Etz · Fri Jan 25, 2019 12:31 am

Found possible bug:

When you add subnet into "available from" field for SSH service, under IP Services...SSH becomes inaccessible, even if PC is in that subnet.
Code: Select all
ssh_exchange_identification: Connection closed by remote host
It seems only to affect SSH though, for limiting access to http, https it work just fine.

Basically happens only: on Hap Ac2 at AP mode (full L2 bridge), still limiting SSH should work, IMHO...

Anastasia · Sat Jan 26, 2019 8:23 pm

bug.
I choose in settings "IP.IPsec.Peers " certificates for the server and remote server. But after some time, the certificates disappear and become "none". I use the method: rsa-signature-hybrid.
why does the certificate disappear? Sometimes it happens that the server and the remote server - certificates themselves become the same.

Anastasia · Sat Jan 26, 2019 10:23 pm

Bug 2
if you use https to connect (together with the certificate), sometimes there are delays of 3..5 seconds when opening various settings. all open quickly but then go to what that tab to view the settings and there is a delay for 3..5 seconds. nothing shows for 3..5 seconds. another problem with https is that it shows different settings compared to winbox.

this is possible due to access to jsproxy, it is not.

kiler129 · Sun Jan 27, 2019 9:16 pm

There's something really strange going on with DFS. I just got a new INTL RB4011 and set it to "united states" regulatory domain with "manual txpower" and 80Mhz channel. The AP is getting stuck in radar detection half of the time (even though I'm 100% sure there're no weather or military radars around, since I live practically in the forest). For example now (see screenshot) it was in "detecting radar" mode for 10 minutes.
It's simply not acceptable for me and AFAIK there's no way to disable DFS while still keeping the scanlist of the regulatory domain (or is it?).

Pea · Sun Jan 27, 2019 10:45 pm

Use manually non DSF channel (5200, 5220 or 5240). Problem solved.

ognjen · Mon Jan 28, 2019 7:50 am

@kiler129 I had this problem. After change change:
-Frequency Mode: superchannel
-Country: no_country_set
-Channel Width: 20/40/80MHz eeeC
my problem is solved. Lets try

Redmor · Mon Jan 28, 2019 8:51 pm

You can't use anymore country settings and frequency mode different from regulatory domain.

NoobJambon · Wed Jan 30, 2019 7:54 pm

hello support!
Could you give us more information about this changelog entry?

*) wireless - improved stability for 802.11ac;

What have been changed? Any improvement in NV2?

Thanks!
Would like to know as well. My RB4011 keeps disabling 5ghz WiFi after a few days (see graph). Only a reboot can bring the WiFi up again. Wondering if this has been fixed

I am having the same problem.

NoobJambon · Wed Jan 30, 2019 8:06 pm

...
mikelaurense - Does interface actually gets disabled? Or it becomes inacessible? If it disabled, then someone has done that manually. Please provide supout.rif file tp support@mikrotik.com. Make sure that file is generated while interface is "disabled".
...

I'm facing the same issue as mikelaurense. When this happens for me, I can see that the wifi interface is shown as "S" instead of "RS". When going in the settings, I can see "Enabled" is still checked but the interface is not shown as "Running". The wifi network in itself becomes inaccessible, as in, it doesn't appear anymore when scanning from another device. There is nothing in the logs about the interface being disabled. Disabling and Enabling again the interface does not fix the problem. Rebooting does.

This happens every few days seemingly at random hours, always during the day when nobody is home (virtually no traffic on wifi) or at night one I sleep (virtually no traffic on wifi).

TimurA · Wed Jan 30, 2019 8:40 pm

hello support!
Could you give us more information about this changelog entry?

*) wireless - improved stability for 802.11ac;

What have been changed? Any improvement in NV2?

Thanks!
Would like to know as well. My RB4011 keeps disabling 5ghz WiFi after a few days (see graph). Only a reboot can bring the WiFi up again. Wondering if this has been fixed
I am having the same problem.

Me too

Muator · Fri Feb 01, 2019 9:50 pm

I launch the terminal, I create the rule.
In the parameters an intentional error, the rule applies.
I look through the winbox, I see a new error parameter perouting.
This is normal ?

[tik01] > ip firewall mangle add action=change-ttl chain=p
postrouting  prerouting

[tik01] > ip firewall mangle add action=change-ttl chain=perouting new-ttl=increment:1 passthrough=yes 
[tik01] > ip firewall mangle ex co                                                                     
# feb/01/2019 19:14:17 by RouterOS 6.43.8
# software id = BI8D-QNXG
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = **
/ip firewall mangle
add action=change-ttl chain=prerouting new-ttl=increment:1 passthrough=yes
add action=change-ttl chain=perouting new-ttl=increment:1 passthrough=yes
[tik01] >

Fri Feb 01, 2019 10:39 pm

This is normal ?

It is. Absolutely. You have simply added a rule to a custom (user-defined) chain named 'perouting' that you can now jump to using 'action=jump' rules.

And, by the say, this is in no way version-specific, so in the future please refrain from posting such questions to version-specific threads.

mikelaurense · Sat Feb 02, 2019 12:13 am

...
mikelaurense - Does interface actually gets disabled? Or it becomes inacessible? If it disabled, then someone has done that manually. Please provide supout.rif file tp support@mikrotik.com. Make sure that file is generated while interface is "disabled".
...
I'm facing the same issue as mikelaurense. When this happens for me, I can see that the wifi interface is shown as "S" instead of "RS". When going in the settings, I can see "Enabled" is still checked but the interface is not shown as "Running". The wifi network in itself becomes inaccessible, as in, it doesn't appear anymore when scanning from another device. There is nothing in the logs about the interface being disabled. Disabling and Enabling again the interface does not fix the problem. Rebooting does.

This happens every few days seemingly at random hours, always during the day when nobody is home (virtually no traffic on wifi) or at night one I sleep (virtually no traffic on wifi).

After contact with Mikrotik support I changed channel width to ‘20/40/80 MHz XXXX’. This does seem to improve stability, although it did happen once or twice again since changing it

TimurA · Sun Feb 03, 2019 1:39 pm

hello support!
Could you give us more information about this changelog entry?

*) wireless - improved stability for 802.11ac;

What have been changed? Any improvement in NV2?

Thanks!
Would like to know as well. My RB4011 keeps disabling 5ghz WiFi after a few days (see graph). Only a reboot can bring the WiFi up again. Wondering if this has been fixed
I am having the same problem.

LTE bell on any phone - kicks wifi on RB4011, any channel from 36-161!

abrandecky · Sun Feb 03, 2019 8:26 pm

Please see how shows "Bytes" in IP-mangle. There are non sense data.
Please fix it in next release.
This problem persists over many versions

Thank you

mrz · Mon Feb 04, 2019 10:04 am

abrandecky please generate and send supout file to support.

Malosa · Mon Feb 04, 2019 7:27 pm

Which one is next stable release? v6.44?

i4ko · Tue Feb 05, 2019 8:06 am

My 750Gr3s seem to show a memory leak in the proxy. With proxy disabled the memory usage is around 42mb. If you enable the proxy but don't send any traffic the memory consumption stays at 42mb. As soon as you open the web proxy interface in winbox the memory consumption jumps to 64mb (still no traffic via proxy). As soon as any traffic flows via the proxy the memory consumption jumps to 102mb. At the same time, if you go and look at the proxy it says Total RAM Used: 996KiB. So something somewhere is leaking close to 60mb. This did not happen before on 6.42.7 which is the version I upgraded from.
Does anyone know how to rectify?
I'm afraid of upgrading my 941 and 952 devices as they don't have the 60mb for the leak and most of them are remote (like 20 hour plane ride away)

td32 · Tue Feb 05, 2019 8:24 am

I'm afraid of upgrading my 941 and 952 devices as they don't have the 60mb for the leak and most of them are remote (like 20 hour plane ride away)

"20 hour plane ride away", my god Please don't. Stay on bugfix or Long-term how it's called now.

emils · Tue Feb 05, 2019 11:16 am

New version 6.43.11 has been released in stable RouterOS channel:

viewtopic.php?f=21&t=144949