MikroTik

bratislav

Can't upgrade one of my hAP lite from 6.44 to 6.44.1 -- "not enough space for upgrade" :( Files are empty, all modules are disabled ( system is active only), 14.3MB free RAM. But how much HDD space is free? That's what's used for upgrade in hAP Lite. Also, disabling packages does not free up HDD sp...

bratislav

This is my first version running a new bridge, don't know if it's a known bug. RB951G-2HnD running as just a Switch/AP (all ethernet+wlan ports under one switch/bridge, no vlans, no nat). If I change the mac address of an ethernet port while it's a member of a switch/bridge, most of the OS will han...

bratislav

That would be nice but unfortunately RBx00x devices are just too big to be mounted side by side in a 19" rack RB2011iL Dimensions Desktop:230x90x25mm Rackmount:443x92x44mm rb2011rack.png Have MikroTik ever had a discussion about the format of rackmounts. So to be able to mount TWO instead of only ON...

bratislav

Seems that new workaround option:

*) wireless - added option to disable PMKID for WPA2;

Does not prevent users to connect and so far everything works well for us ...

bratislav

And what about working on WPA3?

According to Qualcomm you need new chipsets for WPA3 so it seems that old gear wont be able to support it ...

bratislav

I checked this on all our routers upgraded to 6.42 or 6.41 ... And In ROS 6.41 and 6.42 Mikrotik Neighbor Discovery protocol outgoing traffic is actually allowed to bypass firewall altogether and cannot be caught in any chain, not something that any process should be IMHO ... And for me this is actu...

bratislav

Not related to Winbox security issue, but seems like a bug ... On 6.41.x and 6.42.x MNDP trafic is not visible anymore in firewall output chain ... For example I am using this rules /ip firewall raw> print Flags: X - disabled, I - invalid, D - dynamic 0 chain=output action=passthrough log=yes log-pr...

bratislav

Sadly, it looks like the footage was probably all from inside the Raging Wire data center and not an AWS data center. It was still good to see it being used though. Ragingwire is part of NTT, they are data center operator and they are in business of leasing data center space and infrastructure to c...

bratislav

Sadly, it looks like the footage was probably all from inside the Raging Wire data center and not an AWS data center. It was still good to see it being used though. Ragingwire is part of NTT, they are data center operator and they are in business of leasing data center space and infrastructure to c...

bratislav

It surely works in winbox.
Maybe on your routerboard. On rb922 (and others) don´t work

Interesting ... What versions of WinBox/Windows are you using?

bratislav

Also just to be clear on MikroTik APs mitigation is not yet available and the only option is to patch the clients and that maybe impossible especially with Android devices that probably will never receive a patch, so maybe a suggestion for MikroTik to develop something like this and make it availab...

bratislav

To summarize, the client does connect to the fake AP. That's why the researcher enabled ip forwarding on his linux box. Actually there are AP's that will do this (mitigate the 4-way handshake problem). I'm not sure it will break anything with compatibility but we administer a ton of AP's and they a...

bratislav

Apparently AP can mitigate this by "bending" the standard 4-way handshake and instead of re-transmitting message 3... It does not re-transmit anything during attack. It's an attacker who replays the message 3 that was originally transmitted by the real AP. It does actually ... the attacker is repla...

bratislav

The demo from the researcher clearly indicates a man-in-the-middle attack. It is shown in the video on his website around 1:54 https://youtu.be/Oh4WURZoR98 Hence, the client does connect to the malicious AP. You seem to claim the client does not need to connect to the fake AP? You should have also ...

bratislav

You can fix the 4-way handshake issue either at the client side or at the Access Point side. ... So it's good practice to also fix it at the AP side:-). Wrong!!! KRACK is a pure client-side attack. Patching AP will give you nothing. Worse!!! Patching AP will just give some people false sense of sec...

bratislav

You can fix the 4-way handshake issue either at the client side or at the Access Point side. ... So it's good practice to also fix it at the AP side:-). Wrong!!! KRACK is a pure client-side attack. Patching AP will give you nothing. Worse!!! Patching AP will just give some people false sense of sec...

bratislav

Are you sure that you don't confusing "RB1100AHx4 Dude Edition" with one that is announced here "RB1100AHx4"

Yes it is Dude Edition dude ... it is advertised here on top banner at $349.00 ... and that is way cheaper than what we have to pay here ... but enough of me whining

bratislav

I would really prefer if you did not announce the prices ... Local distributors here are selling Mikrotik gear way times more expensive, for example RB1100AHX4 is currently 570$ or 475$ before taxes, so it is pretty annoying to find out that we are being robbed like that, it is better just not to kn...

bratislav

Please plan some method to phase-out bundle package. (i.e. install separate packages from the factory, in some new version replace bundle package with the separate packages from the bundle) Why should Mikrotik do that? Packages are already available separately if you prefer it that way, but bundles...

bratislav

Thank you! I rebooted the router. Free memory 7.4 MB. I updated the firmware, all ok. You are welcome ... on the other hand this make me wonder ... Seems that hAP lite is very tight with RAM memory and that new upgrades can barely fit so problems like yours should be expected in the future ... Mayb...

bratislav

Hi all. I can not update the Mikrotik hAP lite firmware. Error: not enought disk space. It worked fine for me ... although I uploaded the npk file to router manually ... As far as I know files for upgrades are stored temporarily in RAM so there must be something hogging your memory ... You could us...

bratislav

Has anybody noticed this ... RouterOS 6.38.7 in WinBox does not show anything for encryption algorithm if using aes-gcm: gcmwbox.jpg Everything is actually working and command line shows encryption correctly: ip ipsec installed-sa print Flags: A - AH, E - ESP 0 E spi=0x0000000 src-address=1.2.3.4 ds...

bratislav

Make CHR to run on barebone switches. http://www.edge-core.com/productsInfo.p ... 143&id=264

It wouldn't be Cloud Hosted Router than and Mikrotik already has "barenone" hardware that is running RouterOS ...

bratislav

We are mostly VMware customers ... so for me some kind of VCenter integration, for example webfig access, would be really appreciated ...

bratislav

Maybe false alert, seems to be NOT related to 6.40.1. I had a chance to test with a friend's hEX. Worked reliably with 6.40, likewise with 6.40.1, both RouterBOOT 3.35. Thanks for the update ... I was too reluctant to go for 6.40.1 after your post ... now I may reconsider :) Anyways seems to me tha...

bratislav

Are you sure about RouterBOOT version? There is no such version at: https://wiki.mikrotik.com/wiki/RouterBOOT_changelog Also it seems to me that you have to update RouterBOOT separately by issuing system routerboard upgrade and then reboot ... Updated from 6.39.2 to 6.40.1 on a hEX (RouterBOOT 3.35 ...

bratislav

Absolutely agree ... and even the most powerful NGFW can not inspect SSL/TLS encrypted packets anyway (without meddling with Cert Store on each end user devices) ... I'm willing to bet that these virus scanning routers are only slightly better than worthless at actually providing real security from ...

bratislav

It does not work even if I put my vlan on ether1 or 2. It should be like this ... (if your vlans 20 and 30 are on ether2 ): /interface bridge add name=bridge1 add name=bridge2 add name=bridge3 /interface vlan add interface=ether2 name=vlan20 vlan-id=20 add interface=ether2 name=vlan30 vlan-id=30 /i...

bratislav

Shouldn't VLAN be created on Ethernet port, not the bridge ...
Or you are trying Bridge VLAN Filtering and vlan-ids ...

I'm creating VLAN20 on Bridge1 - there's still ok.
But when I add VLAN20 to Bridge2, RB is unavailable on these two ports.

bratislav

You got this wrong ... flash chips are declared in Megabits ... so the prices you found are for 4MB, 32MB and 128MB respectively ... I'm with you guys. I'm not sure what class embedded designers are taught to use tiniest flash chip available on the market but I'd like to alter that curriculum. That ...

bratislav

I really think Mikrotik should discuss using partitions in addition to backups.
Can I make partition(s) on my mAP Lite? It has only 32MB disk space.

Are you sure about that? mAP lite should have 64MB RAM and 16MB flash ... and no you cant use partitions ...

bratislav

100% CPU and can't connect How do you know that CPU is at 100% if you cant connect? And if you can somehow see this could you also check what is hogging CPU? Anyways it may be some DOS attack issue, my advice would be, if you have one spare port, to disconnect router from the network and plug only ...

bratislav

Upgrade went well on RB750GL but DNS has gone berserk check whether you're being used as an attack amplifier look whether /ip dns cache is filled with junk entries Actually you are right ... on that particular router i forgot to close input from internet ...and it was literally bombarded by million...

bratislav

Upgrade went well on RB750GL but DNS has gone berserk NAME CPU USAGE firewall-mgmt 3% ethernet 0.5% console 1% dns 82% firewall 2.5% networking 2% winbox 3% logging 0% management 6% routing 0% queuing 0% telnet 0% bridging 0% unclassified 0% total 100%

bratislav

So again with RSTP on a VLAN that is attached to a Bridge, it is going to send out the BPDU packets to the interface, regardless of VLAN, right? Isn't that how RSTP works on most switches? Unless MSTP or PVSTP is implemented, this is now normal operation mode which is 'normal' to switches operating...

bratislav

Would having MSTP option solve this issue?

Unfortunately Mikrotik is just ignoring this issue and sticks with 16 years old RSTP standard ...

bratislav

No it does not ...
It has been requested but to no avail>
viewtopic.php?t=44921

bratislav

wireless snooper result don't indented in winbox 3.x

What do you mean ...

It seams OK to me ...

bratislav

Could you please add a scroll bar to some windows?

It is unusable on smaller screens ... You could use WebFig for now ...

bratislav

SwOS Features: Rapid Spanning Tree Protocol (only) Is this really a feature in these day and age ... It seams to me MSTP is obligatory option (same as VLAN) for enterprise network switches ... I don't know of any ''serious" switch that does not support MSTP ... and every other vendor supports it eve...

bratislav

Actually there is one small annoyance in the latest versions of winbox ... If I click on a new session (menu/session/new) it does more or less nothing except deleting the IP address from the session text box and I stay connected to the same router but I am unable to close winbox any more ... or exit...

bratislav

I will ask once again..... This problem can be solved? It seems it was promised in version 3.0 http://fs5.directupload.net/images/170124/jswmnnj5.png You should check your display settings, custom screen font or similar, it works fine for the rest of us ... http://fs5.directupload.net/images/170126...

bratislav

Looks good so far ... upgrade from routeros-mipsbe-6.34.6 went without any issues and everything works fine ...

bratislav

Where can I configure LLDP, I cant find anything related to it in "/ip neighbor" or anywhere else. It seams still unimplemented http://forum.mikrotik.com/viewtopic.php?f=1&t=24690&start=50 They have already changed the documentation so we can only hope that it will "magically appear" soon enough ...

bratislav

My upgrade went well but the problem I have is that I can not disable wireless package, that is I can flag it for disablement but after reboot it is enabled again. Everyone who did lose wireless package or sees it as disabled after upgrade - can you please write to support@mikrotik.com and provide p...

bratislav

how do we enable/disable/check status of new feature loop from winbox? i cant find them in my rb2011 interface menu. is this only from terminal? It seems Loop protect feature is not available in this release ... from winbox 3.5 at least ... But it is working from command line: [admin@MikroTik2H] /i...

bratislav

After upgrade to 6.36 wireless-fp got removed as expected, but wireless-rep is missing. I got only wireless-cm2 atm. Where i can get wireless-rep from and is it backward compatible with older wireless packages? You can find it in Extra packages zip archive, it is backward compatible but you should...

bratislav

Upgrade from v6.34.2 to v6.34.5 deleted and disabled SSTP client configuration ... /interface sstp-client> print Flags: X - disabled, R - running 0 X name="sstp-rtv" max-mtu=1500 max-mru=1500 mrru=disabled connect-to=255.255.255.255:443 http-proxy=0.0.0.0:443 cert verify-server-certificate=no verify...

bratislav

Please specify what info would you like to get from LLDP?

You can start from here

:
http://vincentbernat.github.io/lldpd/features.html

The license for lldpd is permissive enough that you can even reuse the source ... and it is smart enough to support various protocols not only LLDP ...

bratislav

There is an ISC-licensed, open source implementation of LLDP called lldpd (obvioulsy :D ) that also supports CDP and other L2 discovery protocols. It is available on most Linuxes, Openwrt and others and it seams to me that MikroTik could use this to deliver LLDP in no time ... there is also ladvd th...

Search found 50 matches