CaPsMAN: Which ports are being used?

The default configuration and official documentation of CaPsMAN suggest that only UDP/5246 and UDP/5247 are being used for communication of data between CaPsMAN and CAPs.

After some changes to my firewall and rebooting the manager, all CAPs went offline and didn’t come back. Took me a while, to figure out that they also communicate via TCP/5246, which was blocked.

Now, that everything is back up and running, I’m really dissatisfied that something like this isn’t documented officially.

I’m running with “request-peer-certificate=yes” and restricting everything on a specific VLAN / L3, maybe this changes the (default) behavior. Nevertheless this should be documented and/or reflected in the defconf.

Here are my current insights:

[kbabioch@rtr1.example.com] > /ip firewall connection print where dst-port=5246 or dst-port=5247
Flags: S - SEEN-REPLY; A - ASSURED; C - CONFIRMED
Columns: PROTOCOL, SRC-ADDRESS, SRC-PORT, DST-ADDRESS, DST-PORT, TCP-STATE, TIMEOUT, ORIG-RATE, REPL-RATE, ORIG-PACKETS, REPL-PACKETS, ORIG-BYTES, REPL-BYTES
#     PROTOCOL  SRC-ADDRESS   SRC-PORT  DST-ADDRESS  DST-PORT  TCP-STATE    TIMEOUT    ORIG-RATE  REPL-RATE  ORIG-PACKETS  REPL-PACKETS  ORIG-BYTES  REPL-BYTES
3 SAC tcp       10.24.63.102     43628  10.24.63.1       5246  established  23h59m59s  1416bps    1520bps           6 187         8 034   1 068 468     634 995
4 SAC tcp       10.24.63.101     55868  10.24.63.1       5246  established  23h59m58s  6.3kbps    2.8kbps           5 142         6 343     961 176     524 807
5 SAC tcp       10.24.63.103     55388  10.24.63.1       5246  established  23h59m58s  0bps       0bps              7 638         9 515   1 318 722     724 911
[kbabioch@rtr1.example.com] > /interface/wifi/capsman/remote-cap/print 
Columns: ADDRESS, IDENTITY, STATE, BOARD-NAME, VERSION, CONNECTED-TIME
#  ADDRESS       IDENTITY             STATE  BOARD-NAME        VERSION  CONNECTED-TIME
0  10.24.63.101  apkg.example.com  Ok     cAPGi-5HaxD2HaxD  7.21.2   41m18s        
1  10.24.63.102  apeg.example.com  Ok     cAPGi-5HaxD2HaxD  7.21.2   41m18s        
2  10.24.63.103  apog.example.com  Ok     cAPGi-5HaxD2HaxD  7.21.2   41m17s
[kbabioch@rtr1.example.com] > /interface/wifi/print 
Flags: M - MASTER; D - DYNAMIC; B - BOUND
Columns: NAME, CONFIGURATION.SSID, CHANNEL.FREQUENCY, CHANNEL.WIDTH
#     NAME       CONFIGURATION.SSID  CHANNEL.FREQUENCY  CHANNEL.WIDTH
;;; operated by CAP 10.24.63.101, traffic processing on CAP
0 MDB cap-wifi1  guest                       5745  20/40/80mhz  
;;; operated by CAP 10.24.63.101, traffic processing on CAP
1 MDB cap-wifi2  guest                       2462  20mhz        
;;; operated by CAP 10.24.63.102, traffic processing on CAP
2 MDB cap-wifi3  guest                       5260  20/40/80mhz  
;;; operated by CAP 10.24.63.102, traffic processing on CAP
3 MDB cap-wifi4  guest                       2437  20mhz        
;;; operated by CAP 10.24.63.103, traffic processing on CAP
4 MDB cap-wifi5  guest                       5180  20/40/80mhz  
;;; operated by CAP 10.24.63.103, traffic processing on CAP
5 MDB cap-wifi6  guest                       2412  20mhz  

Wondering if anyone knows more about this, and/or if there is an official statement / documentation from Mikrotik itself. All of this CaPsMAN stuff is great, when it works, but isn't really well documented - especially since there seem to be major changes with RouterOS 7, wifi-qcom and wifiwave 2 compared to the past.