MikroTik

dada

Hi,

I would like to see PPPoE snooping feature in ROS. It could allow to identify (at login time) to what AP is an PPPoE user connected to for example.

dada

Hi,

Maybe you would like to check FastNetMon. It has a plugin for Mikrotik .....

dada

We have added more details, so that it is more clear: https://blog.mikrotik.com/security/winbox-vulnerability.html thanks, it is much more clear now. Except that the 6.28 version is vulnerable too . I am able to read usernames/passwords from boards with this version using winbox vulnerability explo...

dada

Hi Normis,

what you wrote above may look for someone that 6.40.8 (bugfix) is not secure too. I would like you mention that this bugfix release is secure too (blog needs correction too but it mention that 6.40.8 is OK at least).

dada

Hi, Google revealed for me this github repo (5 month old files): https://github.com/0ki/mikrotik-tools/blob/master/exploit-backup/exploit_full.sh There are some scripts which shows how to enable devel mode on several ROS version exploiting a backup file. In short the attacker must know username/pass...

dada

Hi,

recently I downgraded RB433AH from 6.42.1 to 6.40.8 and I had to bring it back to live using Netinstall. Since I had no access via serial line I have no additional information. What happened to you could explain the problem too IMHO.

Thanks for the posts

dada

For secure connection use api-ssl implementing SSL in our utilities is a problem (time etc). Since the API is proprietary protocol the login phase could be easily changed to not send plain text password and still allow you in the RouterOS to store only hashed passwords. Just make the 'challenge' ha...

dada

Hi, known exploit for Chimay-Red needs to known some info about the device architecture and ROS version to prepare attack against web server code (where to place code on stack which will run the shell). If the attacker knows the version of ROS it can download proper ROS package, extract WEB server c...

dada

Hi,

you have to detect actual ROS version in your script and then you have to fill appropriate commands into a string and then execute the string :parse. An example:

set cfgstr "place you commands here";
local func [:parse $cfgstr];
$func;

dada

That is basically what you have when you set the "allowed from" in the service. At least when you can confine your internal networks using IP subnet declarations. Also, you can match on in-interface in firewall filters. So you don't need to match on source IP when you don't like to. No, it isn't th...

dada

Hi,

another report and still the same attack IP 103.1.221.39. Do the attacker really sends these probes from the same IP? Or it is some bug in Router OS logging improper IP source?

dada

On Czech forum is user which have winbox in IP services allowed only for his private range and is hacked :-( https://ispforum.cz/viewtopic.php?p=228863#p228863 It's possible the attack came from his LAN Hi Normis, the Czech case contained the same IP in the log like the others I have seen yet. The ...

dada

HI,

Does the Fix package exist only for 6.35? Do we have to upgrade/downgrade to 6.35? I think the last batch of these board had higher version of ROS than the 6.35 (but maybe someone in our comapny upgraded them before they landed on my desk)

dada

ROS on newer 922 boards is not able to detect wireless. Mikrotik created a special NPK package to fix it (perhaps to set the chipset to known state ?). New ROses will conta8in the fix too.
All the boards with the problem I have seen yet have serial number starting with 7F240 ...

dada

Hi,

thank you for the explanation.

dada

HI,

on 6.34.4 (hEX lite) I upload a file using scp and after reboot the file disapears. Tried 2 times with the same result. I observed the problem sooner on 6.35 too.

dada

dada,
and ... what we can do with the sutiation ?

As I wrote before - if you think the MT box is working improperly, send message to support@mikrotik.com.

dada

barkas, read with attention whole topic, try to get a basic knowledge in IP ... Sorry I have not a time to teaching every forum reader ... dada, what exactly configuration option can help me to turn on "correct check sum calculation for UDPLite" on the MT box ? :-) I asked for NAT CFG just because ...

dada

HI,

How is your NAT configured? I have checked thelist of protocols in NAT rules and there is no UDP-lite protocol option. So I have no explanation how the MT box can affect the packet at all (SRC IP).

dada

Hi, I had the impression that there is internet cloud between your server and the MT box which could do something with the packet too... if you have proofs that the MT box is causing the problem you should contact support@mikrotik.com with details. I have no personal experience with UDPLite. And I a...

dada

dada, Yes , the MT box threats the packets as usual UDP packets and it is IMHO ok. RTFM, for UDP packets check sum must be recalculated, as well for IP packets and so on ... of course. But when cheksum offloading is active the NIC does this and operating system IP stack doesn't bother with updating...

dada

dude ... Client (see "sent" dump) <---TP5 Cable ---> (LAN port) MT(WAN Port) <---- internet ----> (see "received") -- Server It's not a matter where is computing check sum by stack or by NIC ... On server side we see: Apr 7 12:59:28 hs1-nl kernel: [3735394.447354] UDPLite: bad checksum. From xx.zz....

dada

I am assuming you captured the packet on outgoing interface on the MT which is doing the NAT. In the case if the network card does support IP checksum offloading the operating system will not spend CPU cycles on updating the checksum because it knows the card will calculate it during packet transmis...

dada

NAT - is the Mikrotik box under Router OS ...

so If you are aware of the NAT - what is the problem with the packet?

dada

it looks like something rewrote the SRC IP (from private one to public one perhaps). Is there NAT in the way of the packet?

dada

for the start it would be enough to improve the built-in editor. For example PgUp/PgDn would be fine

dada

You are right, if connection tracking is enabled then you will never be able to find fragmented packet because it get assembly at door. How other company handling this kind of attack? I hope the fragments you want to eliminate are part of some DDoS attack. For example if the attack is made by DNS p...

dada

Okay! Enable IP Fragment option in "Prerouting" chain to mark fragmented packet but its not matching any single packet. If i disable check mark "IP fragment" it start matching packet.. As you already mentioned the problem is probably that ROS does the fragment reassembly automatically when connecti...

dada

new mangle rule/extra/[x] ip fragment

as mentioned before - fragmented traffic is perfectly legal. By dropping subsequent fragments you will probably make more problems than you solve

dada

/system telnet 1.2.3.4 25
/system telnet address=1.2.3.4 port=25

dada

IMHO you should have filters which will not allow to accept longer prefixes (than /24) from BGP peers (among with other things which is not safe to receive from a peer)...

dada

IP scan probably doesn't relay just only on ICMP responces. It probably looks to ARP table too. If there is a device which uses IP stack but doesn't want to reply to ICMP echo request it must answer to ARP query(in other case it has no IP connectivity and it cannot communucate using IPv4 at all ). I...

dada

Hi, Okay so can we go with this, http://www.cisco.com/c/en/us/support/switches/sg300-28sfp-28-port-gigabit-sfp-managed-switch/model.html ? but it says, SMALL BUSINESS :( Dont know why! because it is an entry level switch. I have no experiences with them. I would go with 2960-x with LAN Base licence...

dada

Hi, 5gbps ? I wouldn't not think about CRS in such network. Use something: - better manageable. See the hell of options with strange names and meanings under Switch menu. Near no one option uses a name which is widely used in networking world. Simple things like VLANs are rather complicated here and...

dada

We will revert change which set credentials to admin without password. Yes, please. I would like to say that I got empty password box each time I start the Winbox RC17 - even if previous session was used with manually entered password. (I am using [X] Keep password). hmm strange. After I checked "[...

dada

We will revert change which set credentials to admin without password. Yes please. Now its very annoying. Any change to say something about my other remark? (Closing windows on disconnect...) +1 I am reposting updated list of problems/wishes I sent formerly after RC9 version was released: UI discom...

dada

We will revert change which set credentials to admin without password.

Yes, please. I would like to say that I got empty password box each time I start the Winbox RC17 - even if previous session was used with manually entered password. (I am using [X] Keep password).

dada

3) After multiple requests, we decided to use default admin without password if router is selected from Neighbours list. If that should not be used, then router must be saved in Managed tab. If you are changing something users are used too for long time (like this) you should add a settings which a...

dada

Hello we wanted a script which can call our url every 10 mins and update our database with CPE RoS version and signal strength the url to call should be like http://example.com/cpe.php?mac=_WLAN_MAC&ros=_ROS_VERSION&signal=_WIFI_SIGNAL_STRENGHT in return the php will echo some commands that i want ...

dada

Same story happens again: 6.32.2 [current] was pretty stable after being around for some weeks without too many new comments or disasters. This morning found a client that still wasn't upgraded to 6.32.2 so started the auto upgrade script and AGAIN to my surprise a new 'current' version (6.32.3) is...

dada

Thanx dada. Have you any idea why it si happening only on new, replaced router? There maybe more reasons like different ARP table behavior on the routers - IMHO there is no way how to view all the entries in the cache on ROS (not the valid ones only). If the traffic is directed to valid MAC (i.e. e...

dada

Hi, if you see unicast packets on other than expected interfaces then it means that the switch doesn't know the destination MAC address (so it floods it to all interfaces except the one the packet arrived through)). It can easily happen that gateway's ARP record's lives longer time than the MAC in s...

dada

Hi, IMHO the ROS doesn't show incomplete ARP entries (i.e. the cases when ARP query was not replied by remote host or is not considered valid for some other reason like timeout etc) so it is still possible that you have larger network assigned to some interface of the router and some kind of scan is...

dada

Hi,

why do you thing 5 is greater than 32 ?

dada

IMHO the only way is to use global variables

http://forum.mikrotik.com/viewtopic.php?f=9&t=23041

dada

Well. the default MTU of all the path is 1500 (I mean the path trough my carrier to my remote router) The MTU of all my phisical interfaces is 1500.. but when I create the tunnel, the tunnel the default MTU of the tunnel is 1476 (since GRE is 24byte header) 1476+1500 is perfect.. but if the device ...

dada

Hi,

when there is too much clients on NV2 sector you have to use larger TDMA Period to achieve good throughput. It of course means that ping time goes higher.

dada

Hello. so a plain GRE tunnel (no encryption) over a fiber link (MTU1500) between a central CCR and a remote RB2011 or 1100AHx2. what are the expected performance? on a central HQ I plan to use a CCR 1009 and have 3 tunnels via fiber link to three remote sites: a 10mb, b 30mb, c 300mb full duplex. c...

dada

Thanks, dada! Seems like this is the issue indeed. I've checked the hosts toward which traffic is sent and they are indeed the ones that recently gone offline - ARP entry still exists in the router, but no such MAC address in bridge hosts table. What are my possibilities to prevent such flooding to...

dada

Hi folks, Most of the time everything works fine, but recently this problem started happening time to time: all bridge ports start to transmit exactly the same traffic (~6-8mbps) saturating the ether interface (that VLAN's belong to). I then disable few bridge ports for a couple seconds and everyth...

dada

Is it possible to add one button on the left hand main menu; "close all" At times there are so many windows open you want to start with a new clean empty main window. Restart Winbox with a new Session (or session <none>) Normis, you showed again typical behavior of lazy developer. I met it several ...

dada

Hi, I think ROS is innocent here. I don't know how is the server connected to the routerboard but proably you should check your server settings. The default values for some IP stack features IMHO can cause what you see. I think you should try to check/change values for arp_filter and arp_announce (a...

dada

Excessive flash writings are not solved. Tried on Omnitik for the first time, freshly updated from 6.28 to 6.29 via direct update. Opening the rule in firewall (just double click, no change, no save) adds two writes to the flash each time. Sometimes just opening makes "filter rule moved by user" in...

dada

Hi, I decided to post my list of bugs/problems related to Winbox 3.0rc9 which bother us: Crashes when I start winbox and try to connect to a station sometimes winbox windows silently disappears without warning or error message (Winbox probably crashes). Usually the second attempt to connect is OK wh...

dada

Nope, I'm not using proxy. My scenario is some what similar to http://superuser.com/questions/677068/server-remote-ip-always-returns-ip-address-of-the-default-gateway-router-for It's actually not a MikroTik Problem. I just am not able to configure it the way i want. Thanks I can understand the loca...

dada

Hi,

are you using a proxy or some strange NAT scenario?

And how the problem is related to Mikrotik ??

dada

Hi, I am not using ROS as a DNS server so I have no direct experience with it. But IMHO it is much better to run DNS caching resolvers on another operating system. I thing bind or unbound on linux is good option. And you could use full caching recursive DNS (not just only DNS forwarder as in ROS) wi...

dada

do you know that the drop rules you sent are disabled? If it is not a mistake (CFG taken when you were testing something) the packets are not dropped but they will reach the DNS Resolver. So you have an open DNS resolver which will be detected by remote probes and abused (sooner or later)

dada

Hi,

/log pri

is a way how to get copyable log lines. Although if the log is larger it is not too much comfortable.

dada

Hi,

3.0rc5 - I have problems with BTest - when I measure speed I often see that the graph is showing bad value (the one in the box inside the graph area) and the graph itself is ether not updated or overwrites graph from the older test.
Anybody else with the same problem?

dada

Hi, Thanks for your reply. I see that ether2 is set to half-duplex. But I did not do that. So that is strange. But I can not change it also. Is this maybe the problem? On the server the network interface is set to auto-negotiate and full duplex. But the CRS125 set the port to halfduplex automaticly...

dada

Thanks for the clarification. I misinterpreted the manual article.

dada

For anyone with the same issues. I have contacted support. I expect to hear from them soon. Below is an excerpt of what was sent. I have a RB912UAG-5HPnD w/a Mikrotik 802.ac card with ROS 6.27 installed with the wireless-fp package active. Hi, do you lose connection to the board through WLAN or thr...

dada

Althought I would be more happy when the configuration is more like on big switches (Ciscos especially) and not inventing Mikrotik's own wheel, there is a page with examples which helps to understand how to coneifure the switch chip:
http://wiki.mikrotik.com/wiki/Manual:CRS_examples

dada

Yes, +1. Background scan would be nice. If station can scan, and not disconnect from AP

background radar detection would be even nicer

dada

Hi, manual http://wiki.mikrotik.com/wiki/Manual:CRS_features#Port_Switching states that master port cannot be used to transport data outside the box. But when I connect cable to the master-port I can from attached PC access the device. I am little bit confused. Can I use the master-port to attach ot...

dada

@dada You're using Linux + Wine 1.4.1?

When winbox for Linux? or linbox?

no I am using Winbox on Windows 7

dada

Hi, Winbox 3.0rc5 sometimes doesn't offer Wireless in left side menu (the device has wlan device). I saw it in two cases yet. Each was older ROS (5.21 last time) and in the first case Wireless menu appeared when I started Winbox again. In the second case I was not able to see the Wireless menu even ...

dada

I think you have to create a supot.rif file and ask MT support for a solution...

dada

I would like to see a possibility to configure what interface(s) will be used to send neighbor discovery packets (and mac-telnet packets). I already saw that winbox sent discovery requests only through improper interface (Virtualbox virtual interface, etc). MT support said that I have to disable all...

dada

and what size of subnets(s) do you have directly connected to non-WAN interfaces?

IMHO it is possible that MT uses 512 limit on ARP table...

It looks like someone other had the same problem already:
http://forum.mikrotik.com/viewtopic.php?f=1&t=92208

dada

if you have large subnet attached to LAN interface than a scan for IPs in the range can cause large amount of ARP entries in ARP table. Most of them will be unresolved ones and ROS doesn't show them ...

dada

RB433UL seems to be unusable, IMHO. We bought about 40-50 boards and most of them were already RMAed just after LAB tests. Near all the boards tends to reboot due to kernel failure/watchdog (tried several ROS versions including 6.27) or not to start at all after power up (hanging somewhere in boot l...

dada

when "[x]Open in New Window" is checked nothing happens after Connect button is activated (except some winbox window flickering).

dada

So does that mean with 6dB tx power the real output is also 6dB? If yes the maximum antenna gain connected legally to this device could only be 24dB in my country where 1W EIRP (30dBm) is allowed? Or what does this offset really mean? And is this valid only for AC boards or also older N boards? Tha...

dada

Thanks for the responses guys, care to comment on this capture then?... http://kefalonia-broadband.com/imgs/10.95.40.254_s.jpg I assume the picture is taken from AP side of the link. There is 6.5mbps mentioned in registration table as TX modulation. It could be that the link is in locked modulation...

dada

Now please note that although the actual link speed is fairly fast, I have most of my backhaul links running at around 270Mbps both ways, notice the registered signal level though, I have it ordered by last measured and you can see it is locked at 6Mbps, so although it appears to be running at 243....

dada

Actually it is possible to view Bridge FDB information from SNMP, that is what I have in Dude, I did some investigation recently and found no way using SNMP how to check whether a (R)STP port is blocked or not. When using STP it is important to know of the loop is still blocked on a particular port...

dada

I had This problem also but Lucky i had One stx left from my six pack. I chance the client site and after that no problems. There have not bin any issues after I put the new stx on. I have the old (old it is not only 20 days old) with me and all settings is is the same but wend I put the old on aga...

dada

I am creating a script to check this. I wont have time to test for a while it but if anybody can try this let me know if it works, the script would need to go both ends to work or change it to check rx-rate too on one end: { :local a [/in wi reg get number=0 tx-rate] :put $a :if ($a>=6.5Mbps) do={ ...

dada

Now we have no problem with 6.5 and 6.6. you are a lucky man, then. It is only matter of time when the links will lock. We have had already several locked modulation cases on 6.6. Finnally it happened that Mikrotik support staff was able to see it on live so they installed some debug pakage on the ...

dada

Ive had this problem. I can add just a few bits of info: 1/ When problem occurs, to resolve it no reboot is needed. Just disconnect the wireless client and when it reconnects it's solved till it happens again! 2/ Problem is not solved by not allowing 6.5mbps rate. It just locks on the higher rate a...

dada

Have you any news? A have this issue now in P2MP scenario. AP is rb800 with 5.26. Some clients are locked on 9Mbit on TX. Very bad throughput nothing new. I have many lockups on clients using RB1xx boards but newer boards have the problem less frequently. And it looks when we monitor them they lock...

dada

Now with uptime only 22days. P2P link is locked to 6,5Mbit. Customers call - speed is terrible :? note: you need inspect Last Measured times on client not on AP Yes but what is solution? In configuration P2P links is problem on AP side. Disable/enable wireless solve this problem. When you have lock...

dada

Now with uptime only 22days. P2P link is locked to 6,5Mbit. Customers call - speed is terrible

note: you need inspect Last Measured times on client not on AP

dada

Hello. Any news? Give you remote access for support? I have sent the passwords to support before one hour. Unfortunatelly, from offered list of clients (most of them slow boards), they selected the one which is RB433 and locks not so often. And I am not sure they will want to solve the problem in 5...

dada

When you look at these RB112/RB133 do they show locked down rate? I've seen higher rates on CPE than on AP. the rates on CPE (shown in Registration Tab) are higher than the corresponding ones on AP (usually there is maximum rate displayed). Typically you can find that a 'locked' CPE shows 100% qual...

dada

soon we will have ready a mass monitoring script which will tell us whether there is a location in our network where the lockups occurs frequently. Probably it will not be on a PtP line but on an AP resp CPE routers at customers. The problems on PtP links are relatively rare (although not so rare w...

dada

soon we will have ready a mass monitoring script which will tell us whether there is a location in our network where the lockups occurs frequently. Probably it will not be on a PtP line but on an AP resp CPE routers at customers. The problems on PtP links are relatively rare (although not so rare w...

dada

the only way to fix this low modulation lockup is by uploading special packages and monitor that link till it locks up and then we could try to apply a special package for that and monitor again. And continue to do so till we will find the problem and solution. But to fasten all that we would need ...

dada

Hi, We are observing this problem too (for long time - maybe 1year+). Reported to support several times. Typical signs of the problems is that latency on the link raises (but it depends on traffic on the radios) and the throghput lowers and when you try to find out what happened you see that AP is s...

dada

Don't you need to specify the community string "-c string" with snmpget? /usr/bin/snmpget -c nagios -t 1 -v 1 mikrotik .1.3.6.1.2.1.2.2.1.7.10 iso.3.6.1.2.1.2.2.1.7.10 = INTEGER: 1 SNMP version 3 supports another types of authentication - ones which don't make your passwords publicly available in t...

dada

Hi,

BTW: if you want to use two radios with only one antenna you should look for diplexer. It is something like two narrow filters. It should work but you will not be able to change channels without replacing (retuning) the diplexers. Goot diplexers are not cheap...

dada

On both sides there are RB 411. CPU is around 10% at station side, and 35% at AP side during the highest traffic.

what is the speed and quality on pure wireless (i.e do the test between IPs assigned to the wireless interfaces - 172.16.0.x in the wiki example)

dada

I did set up wireless transparent bridge as written here: http://wiki.mikrotik.com/wiki/Transparently_Bridge_two_Networks_using_MPLS . As i try to check real throughput of this connection, it shows me something around 12Mb/s. When i change only the type of L2 bridge to one based on WDS, real throug...

dada

What mean the first change? *) wireless - improved 802.11n wireless retransmission When sending traffic over wireless links in some rare cases the N data rate could drop to the lowest value and would not recover so fast. This version has a fix for those rare cases. Hi Uldis, are you really sure tha...

dada

I have just checked it with latest ROS 6.3 (downloaded today) on RB532A and the problem is still the same ...

dada

There is no direct way how to send data in ROS IMHO - one of the ways could be configure remote logging action and send the data using fore xampl ':log debug "$mac"' CLI command. And even worse I know no way to read the data (you cannot configure rsyslog receiver). You can do some magic with packet ...

dada

It looks like global variables in scripts are not working. They are not created and cannot be read in scripts. you probably hit the access policy problem. The scripts must have read,write,test,policy rights to be able to access-modify global vars - when started from scheduler or via winbox. When th...

dada

In my case link work stable until we update routers with some of new version of RoS. We can not exactly say which version, because it's been a while since first user reports a problems. Did someone noticed which version works OK on 802.11n and 2*2 MIMO?? on our local ISP forum somebody said that 5....

dada

Interesting. I've experiencing similar issues with my nstream links - links are going down despite strong signal level. I've suspected interference etc. Now I'll try nv2 to see if it will make a change. or you can try to switch (temporarily) to 802.11A (one end is enough - select the nearer one). Y...

dada

My experience with nstreme is that it doesn't work with 2x2 MIMO and it has problems with even 1x1 802.11N. If the 802.11N (1x1 or 2x2) is used with Nstreme than the link quality is poor and the modulation speeds tends to show random behavior. The last test case was before few days. PtP link with 2x...

dada

I have ran into this problem recently too. For years we are configuring our client MT boxes using a perl scripts which creates a configuration using settings stored in database and then another scripts uploads the configuration to the MT box using scp and them runs '/import cfgfile.rsc' on the route...

dada

The same problem with rb532. It mean this bug is for all MIPSLE boards.... i tried RB532A, RB192 and the winbox reported the same problem when I entered IP address into watchdog settings. So you are right entire MIPSLE platform is affected. NOte: when the watchdog IP is filled in before upgrade to ...

dada

HI,

I am just testing ROS 6.0 on RB133 and when I try to enable Watchdog I am getting message "failed to enable watchdog timer":

--
system watchdog> set watch-address=1.2.3.4
failed to enable watchdog timer

--

The same occurs via Winbox when I enter IP address.

What does it mean?

dada

Hi,

does Mikrotik plan to extend IPv6 support in bridge filter rules? If yes, when?

Currently 5.X and 6.X is able to select IPv6 packets but nothing else. I would like to be able to filter using IPv6 IP address, port, IPv6 neighbor discovery etc.

Thanks

dada

Hi how much data are you moving on your wireless link we observe the problem since 5.22 (or maybe 5.21) and IMHO it is not directly connected to high amount of data. There is some race condition in NV2 code either on AP or on client side probably. Note: it seems to we observe two kinds of the probl...

dada

to read the tx/rx signal in the station-bridge, the version have to 5.20 and above. but the old mib file oid is not function, so you need to use... interface wireless registration print oid. then use the oid you can get the tx/rx reading. the problem is that the oid is part of a table. And the tabl...

dada

The wiki should be the primary source of information - clear. However in this thread it's about reaching out to somebody who could provide advice and give plain feedback based on their experience and observations. Agree with me or not, but that wiki article is too synthetic. I am also curious what ...

dada

Anybody?

Every Thing You Always Wanted to Know About Station Modes But Were Afraid to Ask Google:
http://wiki.mikrotik.com/wiki/Manual:Wi ... tion_Modes

The basic difference is that the station bridge mode is Mikrotik's proprietary one.

dada

I propose to discuss the possibility of implementing user authorization in Winbox, using SSL-certificate. Our company uses a lot of RouterBoard and we need a more flexible management of passwords on all RouterBoard. Note: maybe you can use this - you can run a winbox with a command line parameter (...

dada

Just made a lab test with 60db attenuation between the wireless boards (signal approx -50) with 2x2 Mimo and 20mhz channel width - data rates 130mbps. Wireless modes ap-bridge on the AP and station-bridge on the Client. On AP and on the Client ethernet interface is bridged with wireless interface. ...

dada

Is any possible solution of this? Is this also problem of ubnt devices(airmax)? if this is really a problem with too small tcp window than it is caused by the host to host delay. If NV2 takes big portion of the delay the only way is to lower the NV2 delay. If you can try to avoid multiple NV2 lines...

dada

If you have more hops on nv2, and you do the tests using speedtest(your customer, speedtest make one tcp connection) or using btest(one direction, tcp, 1 connection), your throughoutput will be max 15mbit/s. But when you create more tcp connections(20 - default), your throughoutput will be in my ca...

dada

Hi, i am still looking for answer for this situation: A <------> B <-------> C A - rb750 B - rb711HnD (AP) C - sextant (CPE) between A and B is ubiquiti transparent bridge btest A to B 1 tcp session 42 Mbit , 4 sessions 50Mbit btest B to C 1 session 30-35 Mbit , 4 sessions 40-45 Mbit and the riddle...

dada

I just tried an old version of MRTG with :
Target[192.168.75.230-voltage]: .1.3.6.1.4.1.14988.1.1.3.8.0&.1.3.6.1.4.1.14988.1.1.3.8.0:community@10.102.5.24

and it worked. I had to use 2 oids to stop the mrtg complain about _IN_ and _OUT_ targets

dada

So let's assume that I know about TCP/IP. Let's assume that I've been qualified in training MCSE's and the likes on TCP/IP since 1999. Let's assume that I know my way around MikroTik and I run a network of a couple of thousand routerboards. Lastly, let's assume that I've been using MRTG since 1997 ...

dada

maybe you just filled in the trap community but you didn't add any 'access' community - which is hidden behind the 'Communities' button in ROS 5.X. This is what I've done. Capture.JPG Is this wrong? It seems to work just fine in Dude. I have tried v1 and v2. It doesn't matter, wperl still crashes. ...

dada

Needless to say, SNMP is enabled and there is a ver 1 trap community called public.

maybe you just filled in the trap community but you didn't add any 'access' community - which is hidden behind the 'Communities' button in ROS 5.X.

dada

i checked every thing like the pigtail the ALFA CARD (Tried it with R52 card) everything is ok i have selected Ant A which is correct and also the frequency i am using is absolutely free see the attached image 1) the Frequency usage or Scan doesn't guarantee that there is no signal on the same chan...

dada

i am getting about 4Db less signal now does it mean the RX level is about -63dBm now (since the calculated value is approx -59dBm)? Now you should check the signal quality. If it is low then you should find why. It may be an interference with another source on the same channel. Sometimes the proble...

dada

yes i am using grounded cable
and also i have the tx power set to 19Dbm now but same result

what is the RX level after you lowered the TX power? If it is different from the calculated value you should solve the difference problem first (IMHO). The difference approx 5 dBm should be OK.

dada

Dear Sir/Madam after the RBSXT 5HnD connect to the AP , I see Tx/Rx rate with these value : 6 Mbps/6 Mbps in registration tab. why Tx/Rx are 6 Mbps/6 Mbps ? I need more than current value. Note : the distance of our devices is 10 meters ( in my room ) Best Regards the connection is established usin...

dada

no restarts are there and i don't know why the system is working like that(Low signal) previously with TP-LINK 500mw radio the signal margin was 25db and now same with Mikrotik antenna alignment is not changed even a millimeter So you have to check all the components for problems. I would recommend...

dada

Hi, 1) from the picture I can see that your signal levels are -76/-68 dBm. The -76dBm is quite low for reliable link. When I put your params (30dBm TX, 24dBm antenna gain, 14000m distance) into link calculator I get -48dBm of receive level. So if you have antennas connected with short cables (or eve...

dada

Router OS: 5.2 routerboard: yes model: 433AH serial-number: 36C102xxxxx current-firmware: 2.39 upgrade-firmware: 2.41 Workstation: Ubuntu SNMP: net-snmp I am trying to query the Mikrotik hardware for the following OIDs and am having trouble getting results actual results: === overall-ccq === root@N...

dada

Hi, thanks for your reply. - IMHO hw-retries doesn't affect Nstreme. Why? So why i get an effect after increase hw-retries? Ah sorry - I rechecked the hw-retries and since 4.x the nstreme is using the hw-retries. - Nstreme doesn't like 802.11N, especially multichain one. I don't know why nstreme do...

dada

Hi, i have problem with throughput of downloading in one session. Link is connected on -45/-43, CCQ 100%, visibility 100%, distance - over a dozen meters (for test reasons), noise floor -112, fresnel 100%, link connected with 300 Mbps Rates, platform RB711G-5HnD, antennas Jirous Gentlebox JC-320, R...

dada

Mikrotik A (bridge) > wireless > Mikoritk B (station WDS) > patch cable > Mikrotik C (bridge) = wireless PtP to next tower Between A and B, I can push 80Mbps. Between A anc C, I lose throughput and only get about 17-20 Mbps with NV2, and 40Mbps with Nstreme. It seems to be losing throughput the min...

dada

UPDATE: BUG FOUND. Switched to Nstreme, I can push 70TCP over the link and out the ether1 port at the tower. NV2, I can push 90TCP over the link but only 17Mb out Ether1!!! Same thing at our location in Ohio!!! Problem and solution replicated TWICE on 2 setups! Mikrotik, please fix so NV2 bandwidth...

dada

I've had a technician in another market of our's complaining about throughput speeds on the 433GL boards. Such as wireless bridge, slave side, out the ethernet interface. I just witnessed the same thing, even after upgrading to 5.20. I have (2) RB/433's at a tower. Once receiving PtP, and another r...

dada

I would except there is nothing in the Changelog regarding fixing issues with disconnects here it is: *) fix RB951-2n wireless issues; How can this could apply to non RB951-2n hardware? Either you solved something related only to the RB951 (and the changelog line is correct) or you solved something...

dada

At 2.4ghz - there isn't the space on a mini pic form factor for a physical filter - wavelength cant be miniaturized :) FYI: I just found this integrated filter - 2x2 mm package. It should definitively fit into wifi card :-) http://www.rfmw.com/datasheets/skyworks/SKY33106-360LF.pdf IMHO the 11dBm a...

dada

At 2.4ghz - there isn't the space on a mini pic form factor for a physical filter - wavelength cant be miniaturized

Maybe..
Perhaps the filter could be ideally part of an antenna or lightning arrester...

dada

Hi, we have encountered several problem cases when a mobile operator started UMTS service using frequency in 2.1Ghz band. Our AP on 2.4Ghz near the UMTS antennas stopped work properly (good signal from/to clients, very poor quality). After some investigation we found that usual wifi cards R52N, DBII...

dada

1) allow changes of WIFI settings without restarting the card - i.e. without losing the connection whenever possible (changing max TX power level, etc). Maybe even detect that the new settings) of ssid, channel etc) is the same as old one so the connection restart is not needed too. 2) ATPC - i.e. a...

dada

Dear Sir I had configured one point to point link getting RSSI 64/68 but in that the link bandwidth throughfut is only 3mbps , where the hardware is RB433AH, with 800mW card, some times working well but some times it is not working well, Can you please let me know how to improve the signal !! Thank...

dada

yes....all VLAN's are in the same (/24) subnet... please help :-) "all the VLANs are in the same subnet" - it sounds crazy for me. Either I am too tired now or you have something strange in the network schema. If we are talking about routing then IMHO you cannot have one subnet split into multiple ...

dada

hi, i have a RB711-5Hn-M Ethernet port connected to a VLAN with the IP 10.4.2.245/24 i can ping the corresponding gateway 10.4.2.1 but when i try to ping other VLAN gateway's or IP in those VLAN i get error ROUTE not found. parallel i have my laptop connected in the same way with IP 10.4.2.243/24 i...

dada

I found no up to date info related to NV2 and virtual AP. Does the current (5.16) ROS support virtual AP over NV2 interface? I did some test I had was not able to connect the client to the virtual NV2 (client using wireless-protocol=any).

dada

Could you please educate me where I have to change the OID/Name of the SNMP counter (ifHCinOctets instead of ifinOctets) (In MRTG server of Cisco 3750 switch) Please help me with step by step. Thanks in mrtg CFG of course. We are now using MRTG only for some minor tasks (we have our own DB driven a...

dada

Hi, I have an issue with MRTG 200Mbps graph, please help me how to check snmp version on Cisco 3750 switch, how to check whether switch is working on 32 bit counters or 64 bit counters. If the switch is working on 32 bit counters how to change in to 64 bit counters. Thanks & Regards aztech44 the sw...

dada

If the wireless-protocol is set to any your CPE has to scan through every channel for all the protocols until it finds your AP. Set it to NV2 and it will be a lot quicker. probably but then I would lost a way how to quickly change the protocol back to 802.11 in case of a problem. And are you sure t...

dada

If you use nv2, it means you're using v4.x with wireless test pkg or v5 ROS. don't remember the exact specs for rb112, but I've thrown all the 133's away at my expense, because they're useless with v4.. I think nv2 is a little bit easier on cpu than nstreme, so you might get it at least working, bu...

dada

Hi, I am testing NV2 and on one AP when I enable NV2 (using wireless-protocol=any on client stations) there are 2 client boxes which do not associate (even after 5 minutes). It seems the common thing is they are using Philips wifi card (00:05:41:x.x.x). The client installations are rather old ones (...

dada

hi, if wireless-protocol=any on CPE is used there is sometimes very big delay than all the clients associates. On APs with 50-60 clients it can take around 3+ minutes difference between the first associated client and the last one. And the first one doesn't associate not so quick too. I don't know w...

dada

Hi, I would like to have some things clarified about mixed 802.11A and 802.11N mode environment. I have read some papers which discuss compatibility between A and N mode and it looks for me that the Mikrotik box configured into 5Ghz-a/n should be in so called "Mixed mode". Thus it is sending an extr...

dada

airodump and linux did the trick. tried it late yesterday. I saw RTS and CTS.

And then something confusing came out. RTS_TX RTS_RX :X

RTS received and RTS xmitted ?

dada

pussuns dont spam link is not usable it shows nothing just empty search through a site. Ok so I cannot detect it with mikrotik sniffer neither wireshark and plain wifi card. Ill search more on MONITOR mode then :) maybe this will interest you: "If you have trouble getting Wireshark working with exi...

dada

Have you tried to increase hw-retries? What data-rates have you selected?

to my best knowledge the hw-retries are ignored by NV2 (and nstreme too)...

dada

Plain wireless no Nv protocols. How do you see it is working? i tried wireshark and cannot find any rts neither cts packet. the throughput on AP significantly improved and we checked it using a wireless sniffer too. I am not sure you can see management packets just by using wireshark. I think you n...

dada

What is the communication protocol? Is it just plain802.11x or Nstreme/Nv2 is used over it? RTS/CTS protection is used only when you are using 802.11x alone.

We are using RTS/CTS for packets with length over 500 bytes and it does work.

dada

I have got an RB800 with 3 sectors, and have about 75 clients connected, totalbandwithis about 12Mbps. My routerboard only uses max 10%cpu How many client can I connect on that 1 board? Our APs (4xxAH) can handle around 100 CPEs per sector (althougt we usually try to have the number significantly l...

dada

5.12 has a new feature called /export compact as a result of that some paces required to have default entries, that can be adjusted and that can be found in certain way (do the /export compact and you will see how) how to adjust the settings on the default entry, or just disable it. yes, of course....

dada

Hi, I have 5.12 on RB411 and on RB711-5Hn-u.Fl. There is difference in behavior related to some CFG options. On RB711 there is something new under "/system logging" and under "/snmp community". There are so called "default" rules which cannot be deleted. So I had to made a workaround for it in our C...

dada

newer versions of ssh should be fixed already, there where certain issues resolved that impacted speed of ssh command execution. Anyway, we are looking into missing global variable problem. OK, thanks for the info. Anyway I am now using only MT API in my upgrade perl script whenever it is available...

dada

going to look into it. anyway, variables that are already in environment are accessible, just ones that should have been created as result of script executed through api are not for some kind of reason. During an automated cfg upgrade I need to know when the upgrade is done. I am using a global var...

dada

Hi, If I run a script which creates a global variable using MT API the variable doesn't appear in the "/system/script/environment/print" MT API listing nor in ":environment print" CLI list. I am using the MT API under admin account... Is there a way how to solve the problem? What are other differenc...

dada

But the upgrade perl script uses scp to upload new ROS image so I simply used the same way to upload a new CFG... Oh... well... I don't know of a way that part can be migrated to API... but is that part (the upload) at least working OK currently? If not, using FTP instead of SSH is probably going t...

dada

I believe if you use the import command from API and with a tag, you'll get the !done response only after the import is finished, so there's not even a need to watch global variables only to see if importing is done. I can check this - I need to know when the import failed too. If you must though, ...

dada

What SSH commands are you actually using that have no API equivalents? It would probably be best to rewrite those with API syntax. Most single SSH commands can easily be rewritten as several API calls. 1) I need SSH to be able to enable API if it is disabled. This requirement is already obsolete pr...

dada

Hi all, I have a linux perl script which use Net::SSH::Perl to connect and access MT boxes. The script works fine with 2.9.x , 3.x an 4.x ROSes. In the ROS 5.X there is something which causes the script is not able to login. Or if I change the SSH protocol version required to 1 the script is able to...

dada

hi all. I am thinking if the following scenario could work: / (Antenna) - - - (Antenna) \ ETHERCHANNEL(dot1q) -- MTK MTK -- ETHERCHANNEL(dot1q) \ (Antenna) - - - (Antenna) / A Cisco etherchannel on each side, two different links on the same routerboard , both working as bridge. A few vlans will be ...

dada

So...leave the AP RTS/CTS alone. This is how our AP is set at present. If I click on the Hardware Frag Threshold drop down it shows 256 (default) but I have not applied that, just left it like you see here. Is this correct? Everything else looks fine? Thanks The HW. Fragmentation Threshold has noth...

dada

each client MT periodically runs a script which sends RX/TX levels (and some other infos too) to the log. Each MT box is configured to send some logs (script info) to remote syslog server Can you post the script here, thanks The script is nothing special. It is something like this one: #USAGE: # - ...

dada

Hello everyone! I am looking for a script that can be imported to a program or webpage where you can see every client in the networks signal strength history, so if a client disconnects for a weird reason you can look at the history charts and see that it's bad or good signal!? Is this something yo...

dada

If you set 5500 manually to scan-list at the client.
Does it work?

In the first message I described that if the scan-list starts with 5500 (5500-5700) the client connects to the AP. But maybe I didn't understand the question... I didn't try to use 5500 alone in scan-list.

Regards
D. Toman

dada

Run /interface wireless info print and you will see the frequency, which are included into default scan-list (it depends on frequency-mode and country settings). Scan-list=default users frequencies from the info to search for access point. Most likely 5500 frequency is not included there and you sh...

dada

Hi, I have three MT boxes with the same configuration RB411AH, ROS 4.5, R52N. One of them is configured as an AP and the rest as a station. The one client is approx 7km from AP the second one approx 4km. Nstreme (single way) is used and Country is set to Czech Republic The problem: When the client s...

dada

Hi, it happens to us that when we replace the MT box which is using R52 card with r52N one, the signal gets very assymetric. It maybe -80 RX level on the R52N card and -60 on the other side. Sometimes after a while the signal improves sometimes not. Sometimes it starts to be OK when the remote side ...

dada

I have following idea/problem: we have many MT APs and when I run wireless scan I have troubles to identify my radios (my channels) from foreign radios (we hide our SSIDs). Yes, I can use 'Radio name' but it seems wise not to publish much details this way. Because we have many information about the ...

dada

Sorry to revive this 'beaten to death' subject... ;-) So I get it, only enable rts/cts on clients. But what value for HW protection threshold is optimum? 2346(default on UBNT devices)? But with MTU at 1500, would any packet ever reach that size? (Permission to flame me for ignorance is granted) The...

dada

I have to agree with jwcn, it was always available in AP. I mend to say in my earlier post I have it now enabled on all my clients. AP settings are just default. Sorry for the confusion, it was late at night... :? I'm getting a little confused why it's important to know that it was always available...

dada

hw-retries setting for the nstreme were not used in the v3.x Only starting with v3.x wireless-test packages the hw-retries settings were used. It explains our problems. On link which we observed the disconnect problem first we used wireless-test in 3.X. We tried to replace hardware, realign antenna...

dada

Is the NSTREME BIG BUG fixed???????????? BR Normis - is the nstreme working fine and do not disconnecting? Many people waiting for this bug improvement. After upgrade some of our NSTREME links started to disconnect too. I found out that after the upgrade the hw-retries was set to 4. After I increas...

dada

absolutely wrong. if you announce all your prefixes to all your uplinks, but with different prepend - you get full backup, and at the same time you can control, via which uplinks you will receive the traffic for those subnets incoming traffic has no problem, of course. But there is no easy way how ...

dada

Abram, please forget about full feeds! receive only default routes it is usefull only when you intend to use the second BGP peer as a backup one (and the ISPs doesn't want to use OSPF for it). But it will work as expected only when link to main ISP will go down. You will receive the default route e...

dada

How about "disconnected - too many poll timeouts" Did you change the HW retries to 10 on the AP or the AP and CPE? I changed hw. retries on both sides. But it was a PtP link - not AP with many clients. Perhaps it would be enough to increase the retries on only one side ( the side which as problems ...

dada

How about "disconnected - too many poll timeouts" I'm getting this a lot too with the newer wireless-test package with nstreme and polling enabled. One one specific tower, everything is fine if the noise floor is -99 or -100, but if it gets any worse than -98, everything starts freaking out and the...

dada

>>all Queues also

Normis, I have no idea what they should stop working after the Connection tracking is disabled. Are you sure?

dada

what will happen if each CPE has a different setting? 1) I would change the keyword name from required to desired 2) if CPEs are not set correctly (all have to be in 'nstreme desired' mode, of course) it is a configuration bug. If Ap is in nstreme mode all CPEs with nstreme desired or enabled will ...

dada

>>Because older RouterOS uses different software clock. Replace the motherboard and move on. I have faced similar problems when installing 3.28 with wireless-beta on a link made on two older intel mainboards using nstreme. System time on the boxes was fast and link was unstable. After I installed re...

dada

i upgrade from beta 4 to RC1, and have 6 to 10 reboot at day, with kernel failure. RB 433, 1 UB5, 1 r52, 1r52n i added the supout what wifi card do you use? I haw saw kernel failures on 4.x when we tested some obscure card (included in some older Proxim radios). The card seemed to work with 3.x (no...

dada

dont know if i am doing something wrong. i was used to "print oid" to get the signal strenght oid in the reg-table now on rc1 "print oid" shows me the same result as "print" both on reg-table and on system/resources any ideas? add a space to the end of the command (or youse TAB to autocomplete the ...

dada

I noticed that "/interface wireless print advanced" returns the same result as "/interface wireless print". So some advanced settings (RTS) is not visible from CLI. Maybe there is another way to see the settings in CLI? I am used to 'print adv' from wireless-test on 3.x And it would be better to men...

dada

hi, maybe it would be enough to monitor "/user active" for changes by a script started each minute? Store the old current active users into a global variable and check for changes. There is a rick you will not catch short (perhaps automated) sessions whose duration is less than a minute. Much simple...

dada

Update: I have removed the wireless-test packages and it seems the boxes are running OK now.

dada

Hi, I have just discovered that after upgrade of a link made on 1Ghz Celeron small factor boards the link became unstable. When I checked all the settings I discovered that the system clock on one of the boxes runs too quickly (observed using winbox System -> Resources). The seconds were increasing ...

dada

Change TCP Connection Count to 1
It's not a bug, it's a feature. Read changelog!

Thanks for the answer.

dada

Hi,

I have just installed the 3.25 and tried to run a BW test from it. The TCP test doesn't work - 'Test unsupported' is shown.

Are there changes in the BW test (in this case there should be a compatibility mode, IMHO) or is it a bug?

Regards
D. Toman

dada

Hi, what is the right /safe way how to upgrade a MT box which uses wireless-test package? For test purposes I have upgraded about 20 RBs (RB133xx, RB411) with 3.22 to 3.23 and it worked fine (except one case - one RB didn;t booted properly). Then I upgraded 2 RB boxes (RB133C3 with 16MB RAM) from 3....

dada

[New version uploaded 3/26/2008. Fixed a bug which caused command output to hang sometimes, and added simple command line client] Attached should be a ZIP with three files: Mtik.pm - a simple perl client for the Mtik API. Pretty much a perl port of the python client from the Wiki, with an extra rou...

dada

I decided to upgrade one of my ap's and start using the rts/cts in 3.18 and the wireless test. I set it at the access point (not sure I really had to do this) and then started to upgrade and set it at the clients. It worked fine for 5 out of 6 client radios, but the 6th one died after putting in th...

dada

I would add some lines with debug output (log info "some debug output") before/after important code lines. You can log variables content etc to see what happens

Regards
D. Toman

dada

Hi, Does anybody know how to use the :parse command? I have some 1+ year old mail response from Mikrotik support but the suggested usage doesn't work (on ROS 3.11). I have problems in using function 'local' variables and passing values for them when executing the function. If I use: :global func [:p...

dada

Hi Dada, Could you tell me what attenuator you used for this test please? I am trying to recreate what you have done but am getting erratic ping times cause i have not used an attenuator. Cheers Hi, We bought some attenuators from a man who builds antennas for us (very good ones). They are designed...

dada

Hi, First of all I have to say that I compared the test results again and I found that I compared results from different tests (i.e. WiFi speed without EoIP from RB333 and Wifi with EoIP from RB600 tests). I am very sorry for the confusion - I had an impression that the problem is somewhere outside ...

dada

Hi, Formerly I tested RB333 on my desk to see how it works (I used 2 RBs to create a link and measured the speed of data using Bandwidth Test). Now I tested 2 RB600 and to my surprise the more powerfull RB600 showed worse results in my tests than the RB333. Is there anybody who tried to compare diff...

dada

Hi,

FYI: I have just received a notice from Mikrotik support that the problem will be solved in next ROS release.

Regards
D. Toman

dada

Hi, I did another test with 3.0rc13: 1) let's have a cisco switch with RTSP enabled 2) RB333 ether2 connected to a cisco switch's port 2 3) RB333 ether3 connected to the same cisco switch but port 3 4) put the RB333 ether2 and ether3 to the same bridge (STP/RSTP not enabled - left in default mode) 5...

Search found 245 matches