MikroTik

bratislav

As for the hAP ac³ - it is almost 2x the size of the previous model. Pity there is still only 5 eth ports. Well, one is going to be used for the Internet connection, so actually 4 ports ... I use it for my home and my friend wants to redo his home network too, but needs more power. Will be deciding...

bratislav

It would be really nice if for smaller devices like this CSS610-8G-2S+IN switch MikroTik bundles second ear for 10" racks mount that are increasingly popular ... And also (as a separate item) a kit that will make possible to mount two units in one 19" space. May be but on the other hand it seems mo...

bratislav

It would be really nice if for smaller devices like this CSS610-8G-2S+IN switch MikroTik bundles second ear for 10" racks mount that are increasingly popular ...

bratislav

On the version 6.47.4 command repartition (e.g. "/partitions repartition partitions =2") causes the router's cyclic reboot (about every 10 seconds). On versions 6.47.x situation the same. Reset didn't help, I've been able to repare it only with netinstall On the version 6.46.7 this command works co...

bratislav

Also what is the process for 'upgrading' a routerboard that does not have direct internet access from stable to long-term release channel when it is on e.g. 6.47.x? I give it the .npk from long-term, and even set channel to long-term in packages but log says that newer version is installed - seems ...

bratislav

IMHO You shold fix WinBox not ROS ASAP as upgrade to ROS > 6.47 is not always possible And remove Winbox 3.25 from downloads and upgrade ASAP. After struggling for some time with firewall order issue and now with all this wireless killer bugs I am reverting back to winbox64-3.21 that seems to work ...

bratislav

What's new in v3.25: *) added support for CTRL+ and CTRL- keyboard shortcuts for Zoom in and Zoom out; CTRL+ and CTRL- keyboard shortcuts for Zoom in and Zoom out work in Firefox, Chrome, Adobe products. Not in this release of WinBox. I thought you are confusing Webfig and WinBox until you mentione...

bratislav

OpenVPN realization in Mikrotik is still useless due to lack of SHA256/SHA512 support (SHA-1 deprecated https://shattered.io/ ) When SHA512 will be supported in Mikrotik? There is a difference between hashing (as SHA1) and encryption (as AES...) and just because someone is able to generate 2 differ...

bratislav

Many people in poor countries use hAP lite. They usually do not have the ability to buy better equipment. Features like IPsec and hotspot are essential for them. All you have to do is back up your settings before upgrading and reset the router to default configuration, then upgrade router and then ...

bratislav

I have a hap ac which was running on 6.47.1. I upgraded to 6.47.2 and it went well, then on reboot I upgraded the firmware too. But on reboot I couldn't login using winbox. The system was not responding to reset for 4 attempts. On the fifth time it got reset and I could login using winbox. What did...

bratislav

Actually there is much simpler explanation ... those RBs don't need more ... What about partitioning? :) Partioning? We don't need no stinkin' partitioning :D Frankly I find partitioning too much hassle to use on local devices, backups are just fine ... And RBs dont need partitioning, you do so cho...

bratislav

is it REALLY worth it!???? Yes it is. Lets call it planned obsolescence and whats the first rule of planned obsolescence? We don't talk about it! Actually there is much simpler explanation ... those RBs don't need more ... Firstly flash is not used to store firmware upgrade files, RAM is, as can be...

bratislav

Hi i dont believe that i will be able to upgrade my hex3. Only 4.9MiB free but nothing on the flash. Anybody an idea ? Im about 50km away from this box. I would downgrade to an older, much smaller version then upgrade to latest, but in your case that may give problem if you loose some function so t...

bratislav

the latest Linux Kernel 5.6.3 featuring new up-to-date Actually latest is 5.7.6, and latest 5.6 is 5.6.19 which is EOL by the way ... so I wonder why not 5.4 which is longterm maintenance release and will be supported to 2025 unless WireGuard is planned which was introduced in 5.6 (although WireGua...

bratislav

Can't upgrade one of my hAP lite from 6.44 to 6.44.1 -- "not enough space for upgrade" :( Files are empty, all modules are disabled ( system is active only), 14.3MB free RAM. But how much HDD space is free? That's what's used for upgrade in hAP Lite. Also, disabling packages does not free up HDD sp...

bratislav

This is my first version running a new bridge, don't know if it's a known bug. RB951G-2HnD running as just a Switch/AP (all ethernet+wlan ports under one switch/bridge, no vlans, no nat). If I change the mac address of an ethernet port while it's a member of a switch/bridge, most of the OS will han...

bratislav

That would be nice but unfortunately RBx00x devices are just too big to be mounted side by side in a 19" rack RB2011iL Dimensions Desktop:230x90x25mm Rackmount:443x92x44mm rb2011rack.png Have MikroTik ever had a discussion about the format of rackmounts. So to be able to mount TWO instead of only ON...

bratislav

Seems that new workaround option:

*) wireless - added option to disable PMKID for WPA2;

Does not prevent users to connect and so far everything works well for us ...

bratislav

And what about working on WPA3?

According to Qualcomm you need new chipsets for WPA3 so it seems that old gear wont be able to support it ...

bratislav

I checked this on all our routers upgraded to 6.42 or 6.41 ... And In ROS 6.41 and 6.42 Mikrotik Neighbor Discovery protocol outgoing traffic is actually allowed to bypass firewall altogether and cannot be caught in any chain, not something that any process should be IMHO ... And for me this is actu...

bratislav

Not related to Winbox security issue, but seems like a bug ... On 6.41.x and 6.42.x MNDP trafic is not visible anymore in firewall output chain ... For example I am using this rules /ip firewall raw> print Flags: X - disabled, I - invalid, D - dynamic 0 chain=output action=passthrough log=yes log-pr...

bratislav

Sadly, it looks like the footage was probably all from inside the Raging Wire data center and not an AWS data center. It was still good to see it being used though. Ragingwire is part of NTT, they are data center operator and they are in business of leasing data center space and infrastructure to c...

bratislav

Sadly, it looks like the footage was probably all from inside the Raging Wire data center and not an AWS data center. It was still good to see it being used though. Ragingwire is part of NTT, they are data center operator and they are in business of leasing data center space and infrastructure to c...

bratislav

It surely works in winbox.
Maybe on your routerboard. On rb922 (and others) don´t work

Interesting ... What versions of WinBox/Windows are you using?

bratislav

Also just to be clear on MikroTik APs mitigation is not yet available and the only option is to patch the clients and that maybe impossible especially with Android devices that probably will never receive a patch, so maybe a suggestion for MikroTik to develop something like this and make it availab...

bratislav

To summarize, the client does connect to the fake AP. That's why the researcher enabled ip forwarding on his linux box. Actually there are AP's that will do this (mitigate the 4-way handshake problem). I'm not sure it will break anything with compatibility but we administer a ton of AP's and they a...

bratislav

Apparently AP can mitigate this by "bending" the standard 4-way handshake and instead of re-transmitting message 3... It does not re-transmit anything during attack. It's an attacker who replays the message 3 that was originally transmitted by the real AP. It does actually ... the attacker is repla...

bratislav

The demo from the researcher clearly indicates a man-in-the-middle attack. It is shown in the video on his website around 1:54 https://youtu.be/Oh4WURZoR98 Hence, the client does connect to the malicious AP. You seem to claim the client does not need to connect to the fake AP? You should have also ...

bratislav

You can fix the 4-way handshake issue either at the client side or at the Access Point side. ... So it's good practice to also fix it at the AP side:-). Wrong!!! KRACK is a pure client-side attack. Patching AP will give you nothing. Worse!!! Patching AP will just give some people false sense of sec...

bratislav

You can fix the 4-way handshake issue either at the client side or at the Access Point side. ... So it's good practice to also fix it at the AP side:-). Wrong!!! KRACK is a pure client-side attack. Patching AP will give you nothing. Worse!!! Patching AP will just give some people false sense of sec...

bratislav

Are you sure that you don't confusing "RB1100AHx4 Dude Edition" with one that is announced here "RB1100AHx4"

Yes it is Dude Edition dude ... it is advertised here on top banner at $349.00 ... and that is way cheaper than what we have to pay here ... but enough of me whining

bratislav

I would really prefer if you did not announce the prices ... Local distributors here are selling Mikrotik gear way times more expensive, for example RB1100AHX4 is currently 570$ or 475$ before taxes, so it is pretty annoying to find out that we are being robbed like that, it is better just not to kn...

bratislav

Please plan some method to phase-out bundle package. (i.e. install separate packages from the factory, in some new version replace bundle package with the separate packages from the bundle) Why should Mikrotik do that? Packages are already available separately if you prefer it that way, but bundles...

bratislav

Thank you! I rebooted the router. Free memory 7.4 MB. I updated the firmware, all ok. You are welcome ... on the other hand this make me wonder ... Seems that hAP lite is very tight with RAM memory and that new upgrades can barely fit so problems like yours should be expected in the future ... Mayb...

bratislav

Hi all. I can not update the Mikrotik hAP lite firmware. Error: not enought disk space. It worked fine for me ... although I uploaded the npk file to router manually ... As far as I know files for upgrades are stored temporarily in RAM so there must be something hogging your memory ... You could us...

bratislav

Has anybody noticed this ... RouterOS 6.38.7 in WinBox does not show anything for encryption algorithm if using aes-gcm: gcmwbox.jpg Everything is actually working and command line shows encryption correctly: ip ipsec installed-sa print Flags: A - AH, E - ESP 0 E spi=0x0000000 src-address=1.2.3.4 ds...

bratislav

Make CHR to run on barebone switches. http://www.edge-core.com/productsInfo.p ... 143&id=264

It wouldn't be Cloud Hosted Router than and Mikrotik already has "barenone" hardware that is running RouterOS ...

bratislav

We are mostly VMware customers ... so for me some kind of VCenter integration, for example webfig access, would be really appreciated ...

bratislav

Maybe false alert, seems to be NOT related to 6.40.1. I had a chance to test with a friend's hEX. Worked reliably with 6.40, likewise with 6.40.1, both RouterBOOT 3.35. Thanks for the update ... I was too reluctant to go for 6.40.1 after your post ... now I may reconsider :) Anyways seems to me tha...

bratislav

Are you sure about RouterBOOT version? There is no such version at: https://wiki.mikrotik.com/wiki/RouterBOOT_changelog Also it seems to me that you have to update RouterBOOT separately by issuing system routerboard upgrade and then reboot ... Updated from 6.39.2 to 6.40.1 on a hEX (RouterBOOT 3.35 ...

bratislav

Absolutely agree ... and even the most powerful NGFW can not inspect SSL/TLS encrypted packets anyway (without meddling with Cert Store on each end user devices) ... I'm willing to bet that these virus scanning routers are only slightly better than worthless at actually providing real security from ...

bratislav

It does not work even if I put my vlan on ether1 or 2. It should be like this ... (if your vlans 20 and 30 are on ether2 ): /interface bridge add name=bridge1 add name=bridge2 add name=bridge3 /interface vlan add interface=ether2 name=vlan20 vlan-id=20 add interface=ether2 name=vlan30 vlan-id=30 /i...

bratislav

Shouldn't VLAN be created on Ethernet port, not the bridge ...
Or you are trying Bridge VLAN Filtering and vlan-ids ...

I'm creating VLAN20 on Bridge1 - there's still ok.
But when I add VLAN20 to Bridge2, RB is unavailable on these two ports.

bratislav

You got this wrong ... flash chips are declared in Megabits ... so the prices you found are for 4MB, 32MB and 128MB respectively ... I'm with you guys. I'm not sure what class embedded designers are taught to use tiniest flash chip available on the market but I'd like to alter that curriculum. That ...

bratislav

I really think Mikrotik should discuss using partitions in addition to backups.
Can I make partition(s) on my mAP Lite? It has only 32MB disk space.

Are you sure about that? mAP lite should have 64MB RAM and 16MB flash ... and no you cant use partitions ...

bratislav

100% CPU and can't connect How do you know that CPU is at 100% if you cant connect? And if you can somehow see this could you also check what is hogging CPU? Anyways it may be some DOS attack issue, my advice would be, if you have one spare port, to disconnect router from the network and plug only ...

bratislav

Upgrade went well on RB750GL but DNS has gone berserk check whether you're being used as an attack amplifier look whether /ip dns cache is filled with junk entries Actually you are right ... on that particular router i forgot to close input from internet ...and it was literally bombarded by million...

bratislav

Upgrade went well on RB750GL but DNS has gone berserk NAME CPU USAGE firewall-mgmt 3% ethernet 0.5% console 1% dns 82% firewall 2.5% networking 2% winbox 3% logging 0% management 6% routing 0% queuing 0% telnet 0% bridging 0% unclassified 0% total 100%

bratislav

So again with RSTP on a VLAN that is attached to a Bridge, it is going to send out the BPDU packets to the interface, regardless of VLAN, right? Isn't that how RSTP works on most switches? Unless MSTP or PVSTP is implemented, this is now normal operation mode which is 'normal' to switches operating...

bratislav

Would having MSTP option solve this issue?

Unfortunately Mikrotik is just ignoring this issue and sticks with 16 years old RSTP standard ...

bratislav

No it does not ...
It has been requested but to no avail>
viewtopic.php?t=44921

bratislav

wireless snooper result don't indented in winbox 3.x

What do you mean ...

It seams OK to me ...

bratislav

Could you please add a scroll bar to some windows?

It is unusable on smaller screens ... You could use WebFig for now ...

bratislav

SwOS Features: Rapid Spanning Tree Protocol (only) Is this really a feature in these day and age ... It seams to me MSTP is obligatory option (same as VLAN) for enterprise network switches ... I don't know of any ''serious" switch that does not support MSTP ... and every other vendor supports it eve...

bratislav

Actually there is one small annoyance in the latest versions of winbox ... If I click on a new session (menu/session/new) it does more or less nothing except deleting the IP address from the session text box and I stay connected to the same router but I am unable to close winbox any more ... or exit...

bratislav

I will ask once again..... This problem can be solved? It seems it was promised in version 3.0 http://fs5.directupload.net/images/170124/jswmnnj5.png You should check your display settings, custom screen font or similar, it works fine for the rest of us ... http://fs5.directupload.net/images/170126...

bratislav

Looks good so far ... upgrade from routeros-mipsbe-6.34.6 went without any issues and everything works fine ...

bratislav

Where can I configure LLDP, I cant find anything related to it in "/ip neighbor" or anywhere else. It seams still unimplemented http://forum.mikrotik.com/viewtopic.php?f=1&t=24690&start=50 They have already changed the documentation so we can only hope that it will "magically appear" soon enough ...

bratislav

My upgrade went well but the problem I have is that I can not disable wireless package, that is I can flag it for disablement but after reboot it is enabled again. Everyone who did lose wireless package or sees it as disabled after upgrade - can you please write to support@mikrotik.com and provide p...

bratislav

how do we enable/disable/check status of new feature loop from winbox? i cant find them in my rb2011 interface menu. is this only from terminal? It seems Loop protect feature is not available in this release ... from winbox 3.5 at least ... But it is working from command line: [admin@MikroTik2H] /i...

bratislav

After upgrade to 6.36 wireless-fp got removed as expected, but wireless-rep is missing. I got only wireless-cm2 atm. Where i can get wireless-rep from and is it backward compatible with older wireless packages? You can find it in Extra packages zip archive, it is backward compatible but you should...

bratislav

Upgrade from v6.34.2 to v6.34.5 deleted and disabled SSTP client configuration ... /interface sstp-client> print Flags: X - disabled, R - running 0 X name="sstp-rtv" max-mtu=1500 max-mru=1500 mrru=disabled connect-to=255.255.255.255:443 http-proxy=0.0.0.0:443 cert verify-server-certificate=no verify...

bratislav

Please specify what info would you like to get from LLDP?

You can start from here

:
http://vincentbernat.github.io/lldpd/features.html

The license for lldpd is permissive enough that you can even reuse the source ... and it is smart enough to support various protocols not only LLDP ...

bratislav

There is an ISC-licensed, open source implementation of LLDP called lldpd (obvioulsy :D ) that also supports CDP and other L2 discovery protocols. It is available on most Linuxes, Openwrt and others and it seams to me that MikroTik could use this to deliver LLDP in no time ... there is also ladvd th...

Search found 64 matches