MikroTik

cololine

Last month of Q3 is rapidly approaching - how we doin', Mirotik??

cololine

Forcing the router port for your lan connection probably won't work since the switch on the other side is unmanaged, so you have no way to forces similar settings on it. I'd suggest swapping out that switch and/or the cable that connects it to the router (one thing at at time) to see if that fixes it.

cololine

What's a on the other side of the router's LAN port - a switch? Is it managed or unmanaged? If managed, have you check the settings on that device's port that connects to the router? Have you tried going into a different port on the switch, or swapping it out?

cololine

Check the counters on your uplink interface for errors and also have your uplink provider do the same for your side. If it is an issue of mismatched settings, Tx/Rx and/or CRC errors will almost certainly result. While you are at it, you can compare your settings with your providers, and perhaps try...

cololine

I hear you. But if there is going to be a ping function, it should be implemented properly with parameters that can be controlled. Currently it's pretty much useless. BTW I have occasionally seen Ethernet ports go haywire and enter a blocking state, so that's where this ping function could be used. ...

cololine

Hello - Having just started working with the watchdog feature, I see some deficiencies that could be fixed with a few improvements, adding a few new fields/values: 1. More than one target IP for ping - I'd like to be able to specify up to three, because just one IP is putting all your eggs in one ba...

cololine

Update on this: the Watchdog reset was unrelated, that was a goof on my part, and here's a tip for others: if you are going to use the ping feature of watchdog, make sure you are not constraining pings with firewall filters to the point that you start getting timeouts. This can cause the watchdog to...

cololine

Hello all - I've been having a lot of trouble with a RoS installation at one of my sites. It's running on an Axiomtek NA-510. I've had issues with it rebooting itself spontaneously sometimes, other times going unresponsive and having to be rebooted. Interestingly, I've already replaced the unit with...

cololine

Hi all - Reading the wiki docs about Safe Mode, I saw the following: Now, if telnet connection (or winbox terminal) is cut, then after a while (TCP timeout is 9 minutes) all changes that were made while in safe mode will be undone. Exiting session by [Ctrl]+[D] also undoes all safe mode changes, whi...

cololine

going to play devils advocate here... lets ignore the power consumption and heat issues, but talk about distances and number of machines... 13 port router -> 13 48 port switches which each connect to 48 switches, and again the next level... assuming you have 1 WAN uplink on the router, this would g...

cololine

Hello all - Yes, IPv6 implementation is barely at a crawl; I can count my clients who are actually using it on one hand. But it's not to early to get the worry beads out, because a tipping point is coming, some day. My question: can RouterOS in current or even future incarnations really handle the f...

cololine

be careful to log to CF. Ita easy destroyed by to many rewrites. Log to a syslog server, and if you want a lot of information. Log debug. Thanks, I'm using industrial grade CF that supports 2M write cycles and also rotates writing regions like other CF, so I think I'm safe to do this short-term. I ...

cololine

Hello - I'm soliciting suggestions on various types of logging that can be set on RouterOS, that would be useful in analyzing the cause of a router crash. I've already set the four default logging types - info, warning, error and critical - to log to disk so that I have a file to examine after a cra...

cololine

Alternatively this build has worked well for us for the last 2 years ;-) http://www.reddit.com/r/mikrotik/comments/undhn/x86_1ru_mikrotik_our_cheap_reliable_build/ Thanks, but I'm only interested in industrial-grade. We are still on track to releasing within Q3 Awesome, so no later than end of Sept...

cololine

Hi all - It did not take long at all to outgrow those Axiomtek NA-820s (A.k.a. PowerRouter 732 and clones) with their rather meager packet-handling capabilities. Just upgraded two sites to the NA-510, with much faster Ethernet chipsets and Core i7 processors - a pain with the id'ing and renumbering ...

cololine

By IP. And I'm running winbox on Windows 7.

cololine

Hello all - I've updated most of my X86 routers to RoS v5.x. I've noticed that I'm now getting a winbox interface issue on these: after performing a few operations, the interface stops updating: it stays open, but basically all the data freezes: traffic stats in the Interface menu, resources values,...

cololine

So it turns out that Cogent had screwed up my BGP config on their side and were not sending me the route for my loopback, causing all my outbound traffic via the other peer. This being finally discovered after Cogent had sworn to me that everything was okey-dokey on their side. My configs in RouterO...

cololine

I did try various combinations of doing that and it did not work. Thanks for your example, but it's not specific enough for working code: there's an 'in nexthop', 'in nexthop direct', and an 'out nexthop' - which one would I set? Also, there are two sessions for cogent; one for the routes I announce...

cololine

Hello all - I've recently set up that funky Cogent A/B BGP for some redundancy on my router, which already had BGP with my primary provider. Both the regular and loopback Cogent BGP sessions are connected, I'm getting Cogent's full route table, they are getting my announcements, my filters are set a...

cololine

Hi all - Sorry if this is a bit OT, but I'd like to know which of the rOS supported networking chipsets has the best throughput in terms of packets per second? I have SmartBit tests from a couple of the Axiomtek network appliances, which measure packet forwarding efficiency of the unit's Ethernet su...

cololine

RESOLUTION: Hurricane Electric (the carrier with which we were having this issue) requires a 'valid nexthop' or they will drop the nets being announced back to them, so the solution was to chose 'force self' for the nexthop choice in the BGP session. Hope this will help someone else in the future.

cololine

The /24 is not the net in question. I was checking the route using my upstream's looking glass and it confirmed what I was seeing in the RoS Adv list. In any case, this is on hold now as I just found out the client jumped the gun, we've back it all out. Hopefully things will go smoothly the second t...

cololine

That's correct, I am not using synchronize. The client is advertising these subnets with another provider right now, my provider appears to have the routes for those. But shouldn't my advertisement take precedence on their network?

cololine

Update to this: my carrier did a 'soft clear' of the BGP session from their side, and when it came back up, they saw the advertisements for the clients nets. But as soon as their router finished sending me the full route table, the advertisements went away on their side. All along they've shown as b...

cololine

Ok, so I've got this set up... and it's not working. I've added the client's subnets to my networks and filters and I've had the upstream add them to their filters so they can accept them back. They appear to be advertising back to my carrier's side of the session: /routing bgp advertisements print ...

cololine

Yep, it turns out it's just that easy. A little disturbing, though, how easy it can be to hijack someone else's address space. Yes, the upstream won't allow your advertisements through without an LOA, but still....

Ed

cololine

Hello all - I have a client who is going to be bringing in some of their own direct IPv4 allocation. I checked with our carrier, assuming we'd need to get them an LOA from the client authorizing them to announce the client's address space and then accept those same prefixes back from our RouterOS ro...

cololine

Thanks for that, I gave it a look. So did you try the suggestions others posted, or find something else to get your CPU usage down? I read a bit of the Mikrotik docs on Receive Packet Steering and it seems it should be possible to get a significant increase in packet-rate capability with multiple co...

cololine

Hi -

I think you forgot to include the link to your other post - please do so, I'd like to give it a read.

cololine

Thanks for sharing that info. I have been using single-core systems up to this point and I am wanting a performance improvement. Since I started this thread, I have built out an eight-core system but have not put it into service yet. Can you explain a bit as to what kinds of problems you are having ...

cololine

Hello All - I'm looking at upgrading my RoS platform in one of my busiest sites from the current x86 single-core to a single-socket or dual-socket quad-core platform (so four or eight cores total). I understand that RoS 5 now has Receive Packet Steering, which (correct me if I'm wrong) will balance ...

cololine

It's running on a 3.6GHz P4 with 1Gig RAM. But I guess your answer is "until you run out of RAM and/or max out the CPU"?

Ed

cololine

Thanks. Is there a theoretical limit, like perhaps with the MAC address table, at which point performance might suffer?

Ed

cololine

Hello all -

Could not find it in the documentation, so asking here: is there a hard limit to the number of IP subnets or individual IPs (v4 or v6) that RouterOS can handle?

Thanks!
Ed

cololine

Hello all - Running RoS 4.9 x86. I have several simple Queues set up for client VLANs - all are nearly identical to this, only the interface and max-limit values vary: name="Some Name" dst-address=0.0.0.0/0 interface=Some Interface parent=none direction=both priority=8 queue=default-small/...

cololine

There's a hardware installer's manual here, which has a few pages on how to set the text display of the NA-820 LCD. It's one of those ESL-written things, so it can be maddingly vague and confusing at times, but it's a start. I have not tried it: http://eservice.axiomtek.com.tw/attach_files/K07110019...

cololine

Yes indeedee, from snmpwalk: ... IF-MIB::ifHCInOctets.43 = Counter64: 142241289 IF-MIB::ifHCInOctets.44 = Counter64: 6960307 ... At this point I've refined my mrtg cfgmaker statement a bit: /usr/local/mrtg-2/bin/cfgmaker --global 'Workdir: /path/to/workdir' --global 'Options[_]: bits, growright' --i...

cololine

Hi all - I have ROS 4.9, and MRTG 2.15.0 running on Linux. I've been using MRTG with SNMPv1 to monitor traffic on the router without trouble. I want to switch to snmp v3 to take advantage of the 64-bit counters. I followed the example at the bottom this post to configure a community on the router: h...

cololine

The overwhelming likelihood is that it's a bug of some sort. I had the exact same thing happen twice, once while working on an RB1000 remotely, and the second time with an RB1000 sitting right on my desk next to me, connected to my wired LAN. I really doubt that two unrelated incidents happened at e...

cololine

Please take a look at support ticket #2010042266000694, there's a lot of information there. To answer your question: after updating the firmware and logging into Winbox, I was presented with a popup dialog box advising me that I must update the license. I clicked Yes (or OK, don't recall which it wa...

cololine

Incorrect - it's NOT clearly written that the router requires a reboot after the license update, irrespective of any other operations. This is from that note: If you are currently running an older version of RouterOS, where license can't be upgraded to the new format, you can still upgrade, but abso...

cololine

Hello all - Just a word of warning, so you can avoid the unpleasantness that I and a few others have experienced when upgrading from v3.x to v4.x: you must reboot RouterOS after the license update, or it will completely lock you out of the router and cease all routing functions 72 hours later - just...

cololine

Hi Chronos - I completely agree. And my humble opinion is that the RouterBoard products work great - if everything runs perfectly all the time, which of course it does not. The RB1000's worked great for me for most of last year and handled a surprising amount of *legitimate* traffic, in excess of 50...

cololine

I have just experienced a similar issue. I have a RB450G, had 3.28; I upgraded the bootloader, then the firmware to 4.4; I logged in and was met with the upgrade key dialogue; I did what it asked for and received an appropriate key message; rebooted; and everything was fine. No further messages and...

cololine

Same thing just happened to me on an RB1000 going from 3.30 to 4.6. Here's what I did: 1. updated the boot loader via command line 2. Uploaded the new 4.6 ppc firmware to the router an did a reboot 3. Logged back into winbox and was presented with a dialog box advising me that the license key needed...

cololine

Thanks for weighing in. Mac-telent and -winbox apparently only work between two routers, and though the docs do not say so, I suspect they would have to be on the same L2 network in order for it to work. That does not help me or anyone else who has a single RoS device running in a remote location ac...

cololine

Hi all - Just wondering if there is any way to protect an IP address against accidental deletion in RoS? Really my only concern is the IP that's used for management of the router itself. If that was accidentally deleted, the result is no management unless you are right there and can console in (I am...

cololine

How syn cookie works is described pretty clearly here: http://en.wikipedia.org/wiki/SYN_cookies You've been very helpful on this board so far. I'm a firewall newbie, I understand some basics but I'm not real comfortable writing my own rules from scratch and I probably would not know a lean and effic...

cololine

Hi All - I'm currently working on hardening my RoS RB1000's from malicous traffic, and with the help of the wiki, this forum and it's many gracious users I've got several rules in place. One is the SYN protection chain that can be found in the wiki under protecting from DDoS, slightly modified here ...

cololine

According to my admittedly feeble understanding, the syncookie may help valid connections get through if the router is being bombarded with false connections: http://en.wikipedia.org/wiki/SYN_cookies . If that's true, then I want to use it. But I'll definitely give a listen to why I should not. The ...

cololine

Yes, using the extended string of flags in the mangle rule does show an average packet rate that comes pretty close to what I saw with connection-state=new. It also seems to show peaks in more definition, and proves that I occasionally do get bursts of new SYNs that are as much as three times the mo...

cololine

Like this - note that I removed connection-state=new?: /ip firewall filter add chain=forward protocol=tcp tcp-flags=syn,!fin,!rst,!psh,!ack,!urg,!ece,!cwr action=jump jump-target=SYN-Protect comment="SYN Flood protect" disabled=yes /ip firewall filter add chain=SYN-Protect protocol=tcp tcp...

cololine

I took your good suggestion from last night and wrote a mangle rule so I could see what kind of packet rate for new SYNs that I was getting on my network. So I re-enabled that, then removed the 'new' state for a bit. The packets getting tagged by the rule doubles - take a look at the big bump below ...

cololine

dont use connection-state=new... only use tcp-flags=SYN. I also think you need to ! the rest of the flag types if I remember correctly. See if that improves your cpu use. The SYN DDoS attacks work by the attacker sending SYN requests for new connections and then not answering the acknowlegement, so...

cololine

UPDATE: I've now had to push the limit up to 1200/s and the burst up to 300 due to the occasional dropped packet, so I guess the new SYN rates on my network are a lot more burst-y than the values that were being reported in the statistics pane for the mangle filter. Either that, or it's all FUBAR. :...

cololine

So I went ahead and added the mangle rule that I wrote above, and the statistics pane for the rule in winbox showed anywhere between 350 - 600 pps for new SYN packets passing through the router. So then I added the SYN protect lines shown here, increasing the limit value appropriately: /ip firewall ...

cololine

Hi - thanks for the suggestion, sounds like a good one. I'm pretty new to firewall rules and I'd be much obliged if you were to post a sample. Would it be something like: /ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn connection-state=new action=mark-packet new-packet-mark="fo...

cololine

...on the syn rules, instead of connection-state=NEW it should be tcp-flags=SYN ... otherwise you have to check the connection-tracking table for every single one of those, which is more work than just looking at the TCP flags in the packet. if no one posts them I will try tomorrow morning. The rul...

cololine

if your not logging anything, or have anything in the your firewall filters, maybe the attack was against your SSH port, or something directed at the router that would cause it to be busy? Do you know what they were attacking? Normally you could pass that amount of traffic if your not doing anythin...

cololine

Thanks, I've done that once before, so it's easy to repeat. My network has a pretty consistent usage profile so I can probably get by with a shorter sample. So do you if those syn flood protect firewall rules are applied globally, or on a per-destination basis? That makes a *big* difference in the v...

cololine

Hi all - I want to set up the syn flood protect firewall script that's shown in the Mikrotik wiki. That code uses 400 new syn packets over a 5-second period as the threshold to kick in - but I have no idea of this is the right value for my network, nor do I know how to find out, I must confess. What...

cololine

are you logging all those drops? logging will kill a router under any type of heavy load. no firewall rules, no connection tracking, no sniffing or logging. It seems that I should consider adding some global firewall rules to the router to help mitigate attacks. I found this thread: http://forum.mi...

cololine

Hi all - Running RoS 3.24 on a RB1000. Last night one of my colocation clients downstream from the router got hit with a DDoS. The data center NOC said is was a SYN flood and ended up null-routing the target IP address (he stopped counting when source IP entries approached 5000). All is well now, bu...

cololine

I completely understand what you are saying, but I do need to capture and analyze some data during a few anomalous traffic instances that seem to be happening from time to time. Running the sniffer all the time generates loads of traffic to my streaming target and puts a lot of load on the CPU. I'll...

cololine

Unfortunately this does not apply to me. All my equipment: the router and the L2 switch network which distributes bandwidth to clients is in the same data center as the client's equipment. The L2 switch this client is connected to has no means of managing traffic by packet size, I can rate-limit by ...

cololine

Thanks very much for your response - apologies for my ignorance here, but what is the 'CPE' in my context - what does that stand for?

cololine

Hi guys - The subject says it in a nutshell - I'm looking for a script that will start the sniffer with it's the current settings that I've configured in Winbox if the system CPU load exceeds a certain value (which can be hard-coded in the script). I guess this script has to be run periodically from...

cololine

I've seen false spikes too, but that's not the case here. Not only do the traffic, PPS and CPU spikes line up exactly, but there were also corresponding spikes on the router trunk ethernet port, router WAN ethernet port, core switch router WAN and main uplink ports, and on the master traffic graphs ...

cololine

Lower fifo queue size for offending VLAN

I'm already using default-small: 10 pfifo packets. How much smaller can one go?

cololine

How do you know that it was those particular clients? If you control/have access to CPE exquipment it's best to shape traffic there. If each client is connected to particular interface you could limit the rate by changing size of the queue on the interface. The traffic spike which corresponds to th...

cololine

Hi all - Running ROS 3.24 on RB1000 in a data center setting, routing traffic to/from client VLANs via a network of L2 switches. I have a couple of clients in my network who occasionally seem to create or receive little "packet storms": brief bursts of traffic that are moderate in terms of...

cololine

Thanks for looking into that. I adapted that tempate a bit for my device, then pasted it into the mrtg config file for the router and gave it a run. I get this error: SNMP Error: Received SNMP response with error code error status: noSuchName index 1 (OID: 1.3.6.1.2.1.2.2.1.11.11) SNMPv1_Session (re...

cololine

I had suspected a high packet rate of very small packets. I understand what you are saying about the sampling frequency and the possibility to miss small extreme bursts in the graph. However, the client who was implicated in this is on a 100Mbps uplink, so that would be the limit of his burst, and a...

cololine

Hello All - Running ROS 3.24 on RB1000U, doing VLAN routing of IP traffic, most other features disabled, have a few simple queues, that's about it. Today I saw something that is a first in nearly a year (since I put this configuration into production): CPU usage briefly spiked to nearly 100%, and la...

cololine

MikroTik has informed me that they will address this problem in v3.29.

cololine

Ok - given that there's still not much production IPv6 stuff being done at this time (as compared to IPv4), I'll consider the fact that at least one other user has experienced this issue enough cause to open a support ticket with Mikrotik. I could not find much of anything on ND in the docs Wiki, so...

cololine

Hello All - I have ROS 3.24 running on an RB1000. One of my clients behind the router is running IPv6 and I am advertising the subnet to his VLAN. All is well, except that he is complaining that the router responds to solicitations for an IPv6 address from him cleint machines only intermittently. He...

cololine

The changelog for the latest release (v3.27) does not say anything about snmpv2c support improvements. Mikrotik, can you tell us, in what version can we expect this?

Thanks!

Ed

cololine

Well, 90 seconds - 10 minutes is quite a range. I guess I'll write to Mikrotik support on this one. I think that it could be useful to have this as a configurable value.

cololine

Thanks for your input! Mikrotik, can you confirm or correct?

Ed

cololine

Hello all -

I took a quick look through the docs, but cannot find any information on the default ip arp aging time, and how to set/change. Does anyone have any info to share on this?

Thanks!

Ed

cololine

Good news - I've received notice form MikroTik techinical support that they are working on full SNMPv2C compatibility.

cololine

I've moved this discussion to here: http://forum.mikrotik.com/viewtopic.php?f=1&t=32647, because the proper support of SNMPv2C in ROS is feature request for the next verision.

cololine

I've moved this discussion to here: http://forum.mikrotik.com/viewtopic.php?f=1&t=32647, because the proper support of SNMPv2C in ROS is feature request for the next verision.

cololine

Further tests indicated that SNMPv2C support in ROS is pseudo at best; you can get a response to some queries, but it does not support important features over v2C like getbulk and 64-bit counter value returns. One of the developers of the venerable MRTG was kindly working with me on this, and he sai...

cololine

ROS only supports SNMPv1 as far as I know

Clearly it does offer support for v2C, perhaps with some limits, see above test with snmpwalk as well as other posts around this board. But it does appear to need some work.

cololine

Hello - I've been troubleshooting an issue in which I cannot query ROS with MRTG using SNMPv2C, and after some kindly help from the MRTG developers, it appears the issue may be that the current stable version of ROS only offers psuedo-support of SNMPv2C: snmpwalk -c public -v 2c r1.0 SNMPv2-MIB::sys...

cololine

Graphing?..

I did turn off graphing several days ago in a effort to try to reduce the backup file size, but it did not help with several backups since then the file size only went down after that minor change. I suppose it would be easy enough to test though, when I have some time....

cololine

Hello - I have the same issue. I have two RB1000's both running RouterOS 3.24. Each is just set up with some VLANs, IP addresses and a few routes, with one having somewhat more entries than the other. The unit with the fewer entries has a backup file size of about 15KB, the one with somewhat more e...

cololine

Ehm, MikroTik, if you could please support SNMPv2C and only return Counter64 varbinds in SNMPv2C. A lot of SNMP monitors don't like receiving 64-bit counters in SNMPv1. Essentially, you are breaking the RFC's here... The other thing I discovered when investigating this is that I can't even query RO...

cololine

Hello all - Has anyone out there had any luck querying RouterOS via MRTG with SNMPv2c? If I use an binary version of snmpwalk that I found lying around, I do get data back from RouterOS via v2c with that. And MTRG works fine with RouterOS via SNMPv1. But with v2c I just get this from the cfgmaker: S...

cololine

Still no explanation of the big file size discrepancy? Seems very odd...

cololine

We do it with MRTG now. Just query with v1, and then change MaxBytes to 125000000 and it should work. I think : ) Changing MaxBytes will not help if MRTG does not fetch a 64-bit value in v1 mode - the following is from the MRTG docs: SNMPv2c If you have a fast router you might want to try to poll t...

cololine

interface counters are 64bit for a long time already When I try to query the RB1000 in SNMPv2c with MRTG, it does not respond: --base: Get Device Info on public@r1.0:::::2 SNMP Error: no response received SNMPv2c_Session (remote host: "r1.0" [xxx.xxx.xxx.xxx].161) community: "public&...

cololine

Ok, after all that, this problem has nothing to do with ROS. The client machine had picked up an IPv6 address from a different subnet which was being advertised by the NOC - apparently the router was passing these advertisements to all interfaces. The client was using that address on outbound reques...

cololine

Hello - If it has not already been suggested and/or implemented, I'd like to propose 64-bit counters, at least for octets in/out of interfaces and VLANs. I monitor that traffic by fetching it via SNMP with a tool like MRTG. Apparently the counters in ROS 3.x are 32-bit, which means that 5-minute sam...

cololine

i asked that because im wondering if its an MTU issue on the VLAN maybe. Or possibly ipv6 and vlan's don't mix / not implemented yet. Can you continue your testing but using the native ethernet port instead of a vlan? I have been wondering about that myself: if it's a matter of IPv6 not working wit...

cololine

/export is plain config! /export file=mycfg That's true. When I export the whole system I get a file of about 33K in size, and nothing inside that would not be expected. What I am wondering, and what this thread is all about, is why the backup file is so much larger, assuming that it contains essen...

cololine

at quick glance that looks right. can you make it work without vlan ? Yes, I can. Basically, the router takes all client traffic on the WAN port (ether1) and routes it to client VLANS configured on ether2, which goes out to a network of VLAN-segmented L2 switches. The way things are physically conn...

cololine

Well, this has really generated a flurry of excitement on this board! :( I sure wish someone could help me with this. Is anyone out there using IPv6 in production in the data center, like I am trying to do, and is it working for them? I'll post the ipv6 config export below. One thing I did not note ...

cololine

/export ?.. No sir. And those would show up under /file anyway. As I said before, nothing in /file except a 6k auto-before-reset.backup that's been there since the beginning. Any other ideas? Too bad the backup file is binary, otherwise we could just peek inside and see the whole system config. All...

cololine

logs? hotspot? some files stored? branding? I don't have a any custom logs set, just the default logs in the dist, they appear to only be about 100 lines each according to the config. No hotpsots created. No files stored on the file area. No branding. The size of the backup file is now 680KB, up ab...

cololine

Hello - I've got RouterOS 3.24 on an RB1000 in a data center, doing IPv4 and v6 routing. The DC gave me a couple of /64's, one for the router and one for a client machine behind it (mine). I assigned my side of the /64 for the router to the router port that I am using for WAN, and set a route for ou...

cololine

Hello - thanks. I am not particularly worried, just trying to understand why this backup file is so much larger than the other one. I've checked the configs for all the various router features, and I don't see any other services being used that could account for the additional size. There must be so...

cololine

Hello - I have the same issue. I have two RB1000's both running RouterOS 3.24. Each is just set up with some VLANs, IP addresses and a few routes, with one having somewhat more entries than the other. The unit with the fewer entries has a backup file size of about 15KB, the one with somewhat more en...

Search found 106 matches