MikroTik

nuclearcat

You guys should carefully rethink the definition of an exploit. RouterOS already has these checks! It does check also on upgrade. The definition of an exploit is that somebody has found a bug how to overcome or fool these checks. So MikroTik makes new checks and more security wizards. This does not...

nuclearcat

On my opinion, at least for the beginning: 1)Securing rommon. This is holy grail in any security. I dont know if all units has similar architecture, but rommon on some SXT i guess is in MX25L512C, maybe even keeping WP# low by separate IC (some attiny?) and requiring secure key to unlock write. atti...

nuclearcat

It seems that already there is such tool. It could be just extended for some more checks if they are needed
checkinstallation.PNG

It is very basic, just to verify possible filesystem/files corruption, too easy to fool it, and wont cover even known implants.

nuclearcat

The best solution is to always keep your device up to date, always do the maximum possible in securing your devices and keep following announcements and news. Still it is nice, also, if manufacturer(Mikrotik) provide some inspection tools, that makes job of implant authors much harder, and customer...

nuclearcat

There has never been any backdoor. "devel" user is created by installing a special debug package by mikrotik staff, which would appear in the packages menu, and allow a new user "devel" to access the device. The user "devel" uses the admin password, so there is no way ...

nuclearcat

Can you imagine labor cost and downtime comparing with proper integrity verification that is done completely automated way? Yes... What I cannot imagine is such a company leaving webfig enabled and open to the internet (or any other management tools) . Mikrotik would produce such detection package ...

nuclearcat

...So proper solution is needed badly, and will be great if mikrotik can make in very reasonable time some tool, for existing systems, to verify if they have such implants. [...] It will be MUCH more difficult to hide all traces of presence from raw storage reading tool (similar to dd) + memory ins...

nuclearcat

Ouch! I didnt noticed this statement, and it is raising big questions.

nuclearcat

RB1100/1200, CCR - doesnt have such rules.
Often inexperienced admins removed such rules intentionally, to access mikrotik from outside.

nuclearcat

If you opened your management services to the internet and run old versions of software then it's your own problem. Any service exposed to the internet without being updated is in the same situation, expect outdated services to be compromised regardless if it's RouterOS, Linux, Windows, etc. I want...

nuclearcat

v6.38.5 has just been released, with vulnerabilities closed. Everyone please upgrade. RC and Bugfix builds coming a bit later. After people have had time to upgrade, could you share some technical details of how the exploit work or what was vulnerable? Why to give hints for hackers, who will might ...

nuclearcat

Sure, but you still need to wait for Wikileaks to release all information and tools, to know for sure :) . I'm not sitting and waiting on that to happen . Tonight is an update night - hardest decision is to 6.37.5 or 6.38.5... It is already lot of info there. Take a look: https://wikileaks.org/ciav...

nuclearcat

The reason for such tools are inability to release properly patched versions in time. Cisco release cycle and bug fixing cycle takes years. MT just updated all their versions with a fix. Also nobody knows how compromised router actually looks like, so how can you create tool for that? Normis replie...

nuclearcat

They get shell access by exploiting an unknown vulnerability. But the funny part is, we as the owner of these devices with full privileges doesnt have any shell access to play with :) It is time for mikrotik to step up and give us a basic shell where we can check suspicious files etc.. As @nuclearc...

nuclearcat

...So proper solution is needed badly, and will be great if mikrotik can make in very reasonable time some tool, for existing systems, to verify if they have such implants. Are you sure ? You are asking them to write antivirus software for all version till 6.30.2 ? Isn't it smarter to upgrade route...

nuclearcat

As i mentioned in post about statement, other vendors released documents, how to check integrity of systems. I will wait reasonable time any statement from mikrotik, if they plan to release reliable tools for checking integrity, otherwise, if no answer or negative answer - it will play very negative...

nuclearcat

They get shell access by exploiting an unknown vulnerability. But the funny part is, we as the owner of these devices with full privileges doesnt have any shell access to play with :) It is time for mikrotik to step up and give us a basic shell where we can check suspicious files etc.. As @nuclearc...

nuclearcat

Hi, It would be nice if Mikrotik can take some proactive steps. For example IOS/Junos devices has proper shell in devices, and as sysadmin i can inspect system integrity easily, including taking storage/filesystem dumps over dd, checksums for all filesystem files and etc, and i can run also scripts ...

nuclearcat

Hi I have a customers who love your products, are subject to DDoS attacks (SYN flood), and it hurts that Mikrotik doesn't have "notrack" target, just SYN flood over his CCR will knock down CPU to 100%. And if it had -j NOTRACK (or newer kernels: -j CT --notrack), it can be solved, he neede...

nuclearcat

Like I said, there can be no such situation where you have Power, but no Ethernet, and vice versa. Nope :) AP with sector antenna is on Site B, Site A and Site C connected to Site B over wireless, and can't see each other, so Site B is sort of relay. In this case ethernet cable used purely just for...

nuclearcat

Make sure:
1)Fresnel zone clearance
2)Possible signal ducting (on such distances can be very significant)
3)Signal fading due weather conditions

Most probably link will work, but no guarantee it will be stable.

nuclearcat

3 units failed, within 2 month.
All of them near sea, there is a lot of duststorms, plus sometimes there is fog.
Fog and dirt on board wil create a shortcut. I am not sure covering by chemicals will help at all.

nuclearcat

Very good idea indeed, but maybe try to avoid putting inhibitor on parts with RF signal, i am not sure it will not make leakage. RF signal very different from DC. I start reading forums, how people who work on PCB development protecting their products, and as i heard silicone based coating is much b...

nuclearcat

Performance over softrouters are complicated question. Each new feature is imposing processing overhead, and official tests are just done for some predefined configurations. IMO you should test by yourself and estimate how much horsepower you will have, and how much each new feature add overhead to ...

nuclearcat

Seems you are right, MCS 0-7 single stream, but i will try to check later by spectrum analyser, if it is exactly same what i want

nuclearcat

For now if i enable both channels for RX and TX, i will get double capacity (channels are bonded), but it should be possible to have SAME data on TX(links are mirrored/duplicating data, as other vendor have on atheros cards), and RX will use best channel, it will improve link margin around 1-2db, ca...

nuclearcat

ddd thank you for sharing info!
Btw Mikrotik even not answered to my ticket, 4 days passed. Not impressed at all.

nuclearcat

Hi Is it possible to set in Mikrotik MISO mode? While MIMO is to double capacity, MISO is to send same data over both polarisations, and whoever is receiving better - will be primary channel, so it will act as polarisation diversity. Other vendor devices has it, while it cut bandwidth in half, it im...

nuclearcat

normis, thanks a lot, i am already browsing there.
Sure i checked them, but just need feedback, and if someone used successfully some specific products.

nuclearcat

Hi to community again Does anybody know manufacturers for the IP67(or higher) insulated outdoor enclosures with integrated antenna (gain not so important, it is close distance, SXT worked well before)? I have location, very close to the sea with very harsh environment, temperature at day can reach u...

nuclearcat

For me also there is two choices, if it is reset button issue. If corrosion is so fast, i guess i will have to replace SXT at least on this location very soon, because it will corrode also all board. I will need IP67/IP68 with pressure compensation, and i never seen such enclosure for Mikrotik (most...

nuclearcat

Updated information, since team came to office, two units went insane at this location. One unit worked after configuration reinserted, and another one losing configuration continuously. I really hope Mikrotik team can take a look to supout, and if they can see GPIO status, is reset is short or open...

nuclearcat

Hello I'm trying to push mikrotik for new company, and installed 4 links so far , one is RB boards, and 3 is RB SXT. On one location two Mikrotik device suddenly lost configuration (not at same time), it is relay location, and if one i just reinserted config, and it is working fine, on another even ...

nuclearcat

What do you think is the reason people try to switch to 900MHz, 5GHz, 700MHz etc? 2.4 is overcrowded. You have bluetooth devices, microwave ovens, neighbors wifi, and all kinds of other 2.4GHz devices in this spectrum. So yes, it's full of noise, unless you are in the middle of the desert, with thi...

nuclearcat

Thanks If it is required - this code can be extended, e.g. config file for multiple tunnels and etc. If someone using FreeBSD, other flavors of BSD, QNX, Solaris - he can provide patch to make code portable, they have also tap device interface, similar to Linux one. Actually even Windows has tap dev...

nuclearcat

PPP has much higher overhead. Control protocol with authentication and negotiation, plus PPP frame encapsulation, it is also stateful, and can stop in case of packetloss or etc.
EoIP is plain stateless tunnel, which is more stable also, with only 28 bytes overhead (IP header + gre header).

nuclearcat

Since noone said no, here it is:
http://code.google.com/p/linux-eoip/

nuclearcat

I wrote opensource implementation for EoIP in Linux, so now it is possible to link mikrotik in simple way to Linux. For me it was important, because i have some applications under Linux, and i need to bridge mikrotiks to that server some "light" way. Is it ok for Mikrotik if i post link to...

nuclearcat

Just long time i was interested, what means famous Atheros "periodic calibration" and "ANI"(adaptive noise immunity). Many people give "voodoo" explanations, using their imaginations. Some telling it is temperature adjustment calibration, some is telling it is ACK calib...

nuclearcat

Hi2all I notice on my wireless bases, which is WDS + bridge and EoIP till PPPoE unit, that lcnc@GHADEER-BASE] /interface bridge host> print gives only MAC addresses for local interfaces and 2-3 others, while there is 58 CPE connected, about 3 customers on each. So it must be PLENTY of mac addresses....

nuclearcat

promind, Mikrotik images is "set" for specific hardware/peripherals. It's not generic, it will not run on PPC Mac's.
Just because for example CPU is completely different, than Mikrotiks CPU.

nuclearcat

There is no need to go inside Mikrotik. I can get all names of interfaces by walking (it can be done by perl code or even using libnetsnmp, instead forking snmpwalk binary), it is just standart MIB. IF-MIB::ifDescr.1 = STRING: ether1 IF-MIB::ifDescr.2 = STRING: ether2 IF-MIB::ifDescr.3 = STRING: eth...

nuclearcat

FWIW, you can gather this information from SNMP. Not a perfect method, but it is certainly a usable method. Butche, thanks a lot, for a time being it can help in most difficult situations. Probably i will write some tool in perl to get only specific values of interface by name (first getting one by...

nuclearcat

I dont agree about specific drivers. From me it took about 30 minutes to implement interface, and there is various ways to do it (over netlink or plain file /proc/net/dev lookups) Just look to /proc/net/dev. Majority of drivers have "tp->stats.tx_errors++;" at least and similar things. Exa...

nuclearcat

Imho it is too trivial to include it to wiki. Already Mikrotik taking from /proc or somewhere else information about counters, so it is just few lines more in code. Not complicated like other things in WIKI.

nuclearcat

Hi Sent reports with wireless "stale" bug, while all clients is associated, but traffic not able to pass. Got on my home link (x86), and one of bases who i upgrade to rc13. Mikrotik asked me for supout, but it is kind of difficult to do, cause client is down at this time and i cannot reach...

nuclearcat

Hi again

As i understand (and it is logic), polling cannot be enabled without Nstreme. And CSMA-Disable cannot be enabled without nstreme.
Is it possible to "disable" checkboxes? Cause some people thinking, they can enable polling without nstreme.

nuclearcat

1)We faced recently strange issue with lightening - 3 cards in PC, one of the cards was damaged (it is was not shown anywhere, card was visible). All cards was dead (i can change settings, but cards dont see anything in air), cause by "unexpected replies to driver" from damaged card was bl...

nuclearcat

I will send my boss

nuclearcat

IMHO it is another issue, require space diversity actual for 5Ghz links (but not very for 2.* ghz).
It means depends on weather conditions possible path of signal changes.
But this is just an idea.

nuclearcat

What is "defcal" on wireless interface settings, first page?

nuclearcat

I have the same problem. Beta working very bad with stable. Customers disconnecting non-stop even with good signal ime=04:13:22 topics=wireless,info message=00:80:48:41:94:43@OW1: disconnected, extensive data loss time=04:13:30 topics=wireless,info message=00:80:48:41:94:43@OW2: connected, wants WDS...

nuclearcat

Yes, it looks something in bridge. I will remove bridge on my system now and will see if it works fine. Btw at my place issue with "stopped traffic for some time" was caused by system reboot. It was stopped, just because Mikrotik rebooted. No supout actually was generated. Update: It didn'...

nuclearcat

I had something similar. Do you have any queues?

nuclearcat

Same thing for me

nuclearcat

As my expirience show, 5/10 Mhz is worse with same power in NLOS conditions.
For example Atheros XR seems using Turbo (40 Mhz).

nuclearcat

I am not using ripng!!!.
Just i did system, using regular RIP, and trying to do over such way backup with diff's.
in beta10 it is crashing on that stage, thats it...
If there is in menu /ripng, i dont have any glue how to remove it separately without removing whole routing package.

nuclearcat

I cannot install packages, which i am not using.
I guess it is bug, but for me not critical if going to be fixed in beta11. Configuration must be exported IMHO in any case, and it is wrong if i install routing package, i will need install also ipv6 package.

nuclearcat

on export: redistribute-connected=no redistribute-rip=no redistribute-static=no \ router-id=0.0.0.0 /routing rip set distribute-default=never garbage-timer=2m metric-bgp=1 metric-connected=1 \ metric-default=1 metric-ospf=1 metric-static=1 redistribute-bgp=no \ redistribute-connected=no redistribute...

nuclearcat

Dear All
Just question, is Ubiquiti amplifier is working linearly (or almost linearly) (let's say on whole range 4.9-6.1 range)?

Because there is some rumors that its amplifying only in manual-txpower range (unlicensed frequencies?).

nuclearcat

Chinese "big firewall" able to block Skype as i heard

nuclearcat

In RouterOS 3.0 conntrack using new hashes. This tweaking is outdated...
I tested by myself, 500000 concurrent connections, more than 120Mbps real traffic - no difference.
Only one thing HIGHLY useful - net.netfilter.nf_conntrack_max = NNNNN

nuclearcat

WordPress database error: [Table 'tiktube.wp_Counterize' doesn't exist] INSERT INTO wp_Counterize (IP, klucis, url, referer, useragent) VALUES ('195.69.XXX.X','2007-06-26 10:15:18', '/', 'http://forum.mikrotik.com/viewtopic.php?f=7&t=16721', 'Opera/9.10 (X11; Linux i686; U; en)') I delete part o...

nuclearcat

syslog-ng can work fine too (over external scripts, you can make parsing rules)

nuclearcat

I guess without space diversity it will be not very stable.

nuclearcat

It must be bridge mode, which cannot be done in Client-AP mode. It must be WDS or some sort of pseudo-bridge

nuclearcat

Mt2 and MT3 - does they use non-interfering channels?

nuclearcat

I guess you forgot also to put proxy, dhcp, ntp and few more things

RB133 - CPE, i dont think it will handle such load.

nuclearcat

Problems is DOM Flash is still PATA

But i will see, maybe some SATA->PATA convertor available.

nuclearcat

Beta9 - yes It is not connecting even connected PATA IDE, cause controller chip is not ICH. Even most of linux distro had problems, but it is workaround by string in bootloader, and later they add driver for this controller, BUT! in libata (and it appears as /dev/sd*), and Mikrotik use old PATA driv...

nuclearcat

Is it possible to make Intel 965 chipset to be supported? At least to boot mikrotik with options all-generic-ide New Intel ICH chipset is WITHOUT PATA IDE, and for now they include for compatibility Marvell IDE chipset, which is supported only under libata drivers. It is bad to not be able use new I...

nuclearcat

Spectrum size for 802.11a and 802.11g (both OFDM) standart channel 20 Mhz Sure mikrotik have unofficial 10 and 5 Mhz(in theory), but noone know how precise it is and is there "safety spacing". Real spectrum size can show only spectrum analyser, it can be bit bigger or smaller. 802.11b (DSS...

nuclearcat

I would prefer 256QAM miniPCI or PCI or PCI-E. At least it is same result - more bandwidth, but without wasting "air", just by using better antennas. Is there any? And if drivers for Linux available, i guess it will work in near future for Mikrotik also. By the way, maybe such powerful com...

nuclearcat

There is NLOS, and it is not because air is clear. First - Navini for example have on each card manageable number of carriers, on CPE from 1 to 4, each carrier 500 Khz, power of CPE(not sure) 2 Watt, it is disabling power, if human coming close to CPE or taking it to hands, to not harm customer by R...

nuclearcat

2Mikrotik guys

If you are using 2.6.20 kernel, and sch_htb or mirred(iproute2 action) - check please netdev maillist, i report few critical bugs in them and they are fixed in git tree. They can cause kernel panic.

nuclearcat

Close by firewall access from WAN interface to port 8085

nuclearcat

IMHO 64-bit build is useless. x86_64 gives ONLY memory management for >2GB ram's. No significant performance win.

nuclearcat

All of them IMHO use cheap quartz oscillator(cheap cards and expensive cards). Maybe GPS can be possible with (sure on wireless card): http://en.wikipedia.org/wiki/OCXO and smth called TCXO. http://www.meinberg.de/english/specs/gpsopt.htm By the way in GPS they use them, u can see that on link. As i...

nuclearcat

First thing as i heard, from RF engineers, frequency synthesizer even is unstable(drifting depends on voltage and temperature), and some of them changing it to some much more expensive component, and thats give miracle results. Info unconfirmed, but looks like that it correct. This is just cheap min...

nuclearcat

I guess, for proper GPS Sync also it will need not Atheros zoo (each card have own bugs, specs and etc), if will need specially designed SoC, where is everything inside. I dont think it will be possible on known miniPCI hardware...

nuclearcat

As idea, maybe better to make ability, to make graph of any monitored value? SNR, Noise floor, etc...

nuclearcat

I heard many times, that some developers did on Atheros SoC+vxworks support for more than 40 Mhz. So in theory it must be possible. But i didnt heard about QAM256.

nuclearcat

Well, i did that on my embedded solution long time ago. Only important question - small initramfs with klibc+simple app, which will do delay, until usb-storage become ready and mount it.
But that way maybe not useful for mikrotik...

nuclearcat

Agree, useful feature.

nuclearcat

Well, i didn't try yet. Seems because http://www.mikrotik.com/testdocs/ros/2.9/ missing this point, i didnt knew that. I will try now, thanks for info. Seems i am becoming old and not doing experiments :-) upd: small line, "secure ftp is supported". Well, i think mikrotik must explain, tha...

nuclearcat

Mikrotik already supporting MTD devices, which was extremely difficult task. You can just use that (MTD) layer, and convert block-device(SCSI/sda, for usb-storage) to MTD, i was doing that already on my Linux solutions. Additionally all libata(and old IDE drivers will be deprecated) uses SCSI device...

nuclearcat

I want to ask about SCP support, as client and server. Why? 1)You dont need to keep 21 port open. 2)File transfer is secure, authorization MUCH more secure. FTP pass can be sniffed, and that will make a lot of troubles. 3)Easy to manage by firewall (FTP open random ports). 4)Useful to schedule for e...

nuclearcat

maybe then "duration=N" ?

nuclearcat

Normis, reasons why USB Flash much better. Temperature range. Flash)Most is -10 to +60, Extended: -40°C to +85°C HDD)Maximum operating temperature change even is limited, and operating range 0-60C Size of solution. Especially for Mikrotik - HDD not suitable at all, as i know modern HDD's not less th...

nuclearcat

yes, i really need that too
at least something like "once" parameter, to limit scan only for one time

nuclearcat

There is special "extender" cable for sticks. You can put stick inside computer case.
If you are maximum worried about such case - most modern motherboards have USB host pin's on motherboard, you can connect stick directly to them, inside the case.

nuclearcat

interlink - same for me, it is saying reason "data loss" when disconnecting, and i can see when compression on - ccq and signal becoming unstable.

nuclearcat

What is a cards?
CM9, and links >10 meg - it's worst with compression on

link becoming unstable
possible card overheat?

nuclearcat

Hi Versions of RouterOS 2.9.38, 2.9.39, 2.9.40 Who experience worst results, when run Atheros compression? On my own expirience when i enable on my test links compression, performance dropped, some links start disconnect suddently, signal become unstable. Does anybody have same experience and results?

nuclearcat

As i know it is using a lot small packets, and causing high PPS, which is killing wireless. Especially if you dont run Nstream - it will kill 802.11a/b/g instantly.

nuclearcat

Also, based on my personal expirience - there is nothing to win, x86_64 in some applications lose, and in some win, only one good thing - support of big amounts of RAM, which is useless for most applications, except proxy. Plus most of the drivers have issues with DMA/memory addressing in x86_64, la...

nuclearcat

On RB532 there is powersaving mode in AP, in CPU settings cpu-mode (power-save | regular; default: power-save) - whether to enter CPU suspend mode in HTL instruction. Most OSs use HLT instruction during CPU idle cycle. When CPU is in suspend mode, it consumes less power, but in low-temperatire condi...

nuclearcat

When you block port 1863, msn will use connection over HTTP In logs it looks like 1170741586.866 1049 195.X.X.X TCP_MISS/200 433 POST http://207.46.107.35/gateway/gateway.dll?Action=poll&SessionID=248323619.XXXXX - DIRECT/207.46.107.35 application/x-msn-m So you have to do ACL on proxy also, to ...

nuclearcat

Is it possible to include to Mikrotik 2.x branch new Intel driver for TCO Watchdog? Seems it can be VERY useful. It is called iTCO_wdt in kernels 2.6 Or at least if possible in Mikrotik 3. Because we have issues with hardware(crashing/full lockup), and i guess it will be much more reliable, if hardw...

nuclearcat

Where i have to send this bug report? seems noone answering.

nuclearcat

I will try to explain situation, which possible will let to reproduce it. Host MK-1 Two interfaces (ether1, wlan1) keypoints: add chain=BADROUTE prefix=2.2.2.0/24 invert-match=no action=discard comment="" \ disabled=no (i tried reject also) add interface=ether1 receive=v2 send=v2 authentic...

nuclearcat

I think there is only one the way - to write your own drivers.

nuclearcat

Can i know why it is deleted? I will post again, cause i didnt see any rule, which it abuse. Dear community Just i have now one idea came in mind, because i have similar problems with proprioetary OS'es. Usually it is required to install some linux software, and i feel already installed software is ...

nuclearcat

I think best idea to start from:
http://www.mikrotik.com/docs/ros/2.9/
and
http://wiki.mikrotik.com/wiki/MikroTik_RouterOS

nuclearcat

I was trying to explain, that i am not rookie in such things.

Is there a way to send you private message? Maybe over talkroom? Or email? I want to give move explanation about current situation, maybe you can give me advice also, but it is not for public.

nuclearcat

I didnt said it is simple linux distribution, it is even i think more far from linux, than any other distribution :) It is totally different, and you have done very useful CLI and GUI interfaces, which make it totally different from Linux, and very easy to manage for newbies, and in same time it is ...

nuclearcat

if you handle it over iif (ip rule add dev), it is handled directly in kernel code net/route.c (RTA_IIF option). If you are using iptables with mangle, you have to run netfilter, where is routine will do lookup of incoming interface(in netfilter), mark a packet, route.c will lookup for mark in packe...

nuclearcat

normis, agree.
But maybe it is more correct (for performance reasons, because on my example you dont need to use netfilter) to add one more option in next release for source routing?

nuclearcat

In mikrotik i didnt see option, which can classify packet by source interface, means interface from where packet came.
I have readed this manual already.

nuclearcat

I have looked to manual, and seems i need to describe why i need this kind of command For example we have a box with 2 interfaces, wireless and ethernet (usual PtP setup). Both sides have huge amount of networks, let's say: BOX1 - eth0 - 10.1.0.0/24, 4.5.6.0/30 , ...... and 100 like this BOX2 - eth0...

nuclearcat

Is there option, similar to linux:

ip rule add dev eth0 table 201

So i can chose routing table depends on interface where is traffic came.

nuclearcat

On my opinion ipv6 kernel/packages must be optional(means if you want - you install it), and separate. Because they will make i think system bigger and slower, which is critical for embedded applications.

nuclearcat

New MSN have also stupid features to check connectivity quality (As i know it send packets to echo port, maybe it is the issue). Most of the lebanese ISP's seems dont fit Micro$oft standarts :D Offtopic: Ramona, are you interested to work in Virtual ISP(Lebanon)? Seems you know well networking stuff...

nuclearcat

From 2 sources it is leaked, that Atheros have FEC(forward error correction) capabilities.
It can be useful for long-distance, and VERY useful for NLOS.
Already canadian linux based system and BlueBox have capabilities to turn this bits on. Mikrotik must have too.

nuclearcat

Is there option in Mikrotik to set 5/10 Mhz spectrum width?
I so it in few messages, but seems there is no information in online manual.
Can anybody give idea?
We are going to buy big amount of boxes, so i want to be sure, all options, what i need - is available.

Search found 115 matches