Device appears with two MACs in hotspot

RouterOS Beginner Basics
1

Hello world !!!

I have a small network of MikroTik routers and wireless devices.
My problem is that in the hotspot of the central device, the other
devices connect with changing MAC addresses.
For example :
In hotspot I have the following bindings :

E4:8D:8C:CB:8C:0C 1.1.1.11                        1.1.1.11        hotspot  
E4:8D:8C:CB:8C:0D 1.1.1.11                        1.1.1.11        hotspot

The device 1.1.1.11 is set up as a wireless repeater :

 #     NAME                                TYPE       ACTUAL-MTU L2MTU  MAX-L2MTU MAC-ADDRESS      
 0   S ether1                              ether            1500  1598       2028 E4:8D:8C:CB:8C:0C
 1  RS wlan1                               wlan             1500  1600       2290 E4:8D:8C:CB:8C:0D
 2   S wlan2                               wlan             1500  1600       2290 E6:8D:8C:CB:8C:0D
 3  R  intern                              bridge           1500  1598            E4:8D:8C:CB:8C:0D

The bridge contains WL1 (station) and WL2 (virt.AP). Connected to Ether1 is only PoE, no data.
Why does eth1 appear in the hotspot when there cannot be any traffic ?
And why does sometimes both MAC show in the hotspot with address 1.1.1.11 ?
In that case one has the binding an one gets a dynamic IP, but 1.1.1.11 is unreachable.

The problem of the above example occur on any hotspot from ROS6.40.1 to 6.41.4 with
WDS enabled devices connected. Maybe the reason lies here, but I do not know how
to get it donw.

Any suggestions ?

2

In bridge setting, set admin-mac. If not set it will jump between macs of attached ports.

3

Thx 2frogs.
Seems to have worked on all but two devices.
I´ll check if I made a mistake.
Wayne

4

Problem still there.
Even worse : the same behaviour happens on other
devices after update to 6.42.3.
Worked perfect before the update.

When I set admin-mac to 00:00:5E:80:00:XX it does not help.

5

No further hints ?
Now I have some devices with three MACs in hosts list.
Shouldn´t the admin-mac appear in the hosts table of
the hotspot server ?

6

Hi, again.

Maybe some further information might help:
On the hotspot device (/ip/hotspot/hosts) I have :

10 SP D4:CA:6D:9F:88:0E 1.1.1.7         1.1.1.7         Sonnensee
...
16 D  D4:CA:6D:9F:88:13 1.1.1.7         1.1.1.76        Sonnensee

In "bindings :

11 P D4:CA:6D:9F:88:0E 1.1.1.7                         1.1.1.7         Sonnensee
14 P D6:CA:6D:9F:88:13 1.1.1.7                         1.1.1.7         Sonnensee
15 P D4:CA:6D:9F:88:13 1.1.1.7                         1.1.1.7         Sonnensee

The third entry does not appear very often, but sometimes. It is the MAC of the
bridge and WLAN1 on device 1.1.1.7.
First one is Ether1, second one Wlan2.
Both are members of the bridge.
Bridge´s “admin-mac” is 00:00:5E:80:00:04, but it is only shown when I edit the
bridge. Not in /interface bridge print or export, not in the hotspot.
For what is it ?
And how do I get rid of this behaviour ?
Device is RB751U-2HnD with ROS 6.42.2 (stable)

Thanx

7

Post /export hide-sensitive.

8

Thanks 2frogs for taking your time.

Export of hotspot device :

/interface bridge
add fast-forward=no mtu=1500 name=intern protocol-mode=none
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-onlyg country=germany disabled=no \
    frequency=2472 frequency-mode=superchannel mode=ap-bridge radio-name=\
    gateway ssid="Sonnensee I" wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether4 ] name=ether4/wlan-platz
set [ find default-name=ether5 ] name=ether5/NVR
/interface l2tp-client
add connect-to=85.183.140.67 max-mru=1460 max-mtu=1460 name=l2tp-out1 user=\
    sonnensee
/interface pptp-client
add connect-to=213.158.104.34 disabled=no name=MT-Sonnensee user=MT-Sonnensee
/ip neighbor discovery
set wlan1 discover=no
set l2tp-out1 discover=no
/interface wireless security-profiles
set [ find default=yes ] group-ciphers="" supplicant-identity=MikroTik \
    unicast-ciphers=""
/ip hotspot profile
set [ find default=yes ] login-by=cookie,http-chap,http-pap
add dns-name=wicon.info hotspot-address=1.1.1.1 login-by=\
    cookie,http-chap,http-pap name=hsprof1 use-radius=yes
/ip hotspot user profile
set [ find default=yes ] idle-timeout=10m keepalive-timeout=10m rate-limit=\
    64k/512k
add idle-timeout=10m keepalive-timeout=10m name=ma rate-limit=64k/512k \
    transparent-proxy=yes
add name=nolimit shared-users=5 transparent-proxy=yes
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=hs-pool-6 ranges=1.1.1.50-1.1.1.240
/ip dhcp-server
add address-pool=hs-pool-6 authoritative=after-2sec-delay disabled=no \
    interface=intern lease-time=1h name=dhcp1
/ip hotspot
add address-pool=hs-pool-6 disabled=no idle-timeout=15m interface=intern name=\
    Sonnensee profile=hsprof1
/queue simple
add limit-at=4M/4M max-limit=4M/4M name=dsl_queue target=ether1
/queue interface
set ether4/wlan-platz queue=ethernet-default
set ether5/NVR queue=ethernet-default
/routing bgp instance
set default as=100 redistribute-connected=yes redistribute-static=yes \
    router-id=172.18.255.43
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
set 3 remote=10.1.1.1
/interface bridge port
add bridge=intern interface=ether5/NVR
add bridge=intern interface=ether4/wlan-platz
add bridge=intern interface=ether3
add bridge=intern interface=ether2
add bridge=intern interface=wlan1
/ip address
add address=1.1.1.1/24 interface=intern network=1.1.1.0
/ip dhcp-client
add default-route-distance=0 dhcp-options=hostname,clientid disabled=no \
    interface=ether1
/ip dhcp-server lease
add address=1.1.1.29 always-broadcast=yes comment=solar mac-address=\
    00:30:56:A5:B2:3F server=dhcp1
add address=1.1.1.21 client-id=1:0:23:54:7f:73:a7 comment="rechner rezeption" \
    mac-address=00:23:54:7F:73:A7 server=dhcp1
add address=1.1.1.23 client-id=1:bc:ae:c5:bd:37:a0 comment="PC Lager" \
    mac-address=BC:AE:C5:BD:37:A0 server=dhcp1
add address=1.1.1.26 client-id=1:0:1f:1f:75:4a:46 mac-address=00:1F:1F:75:4A:46 \
    server=dhcp1
add address=1.1.1.27 client-id=1:0:f:fe:7c:66:4e mac-address=00:0F:FE:7C:66:4E \
    server=dhcp1
add address=1.1.1.25 always-broadcast=yes client-id=1:b0:65:bd:2d:41:19 \
    mac-address=B0:65:BD:2D:41:19 server=dhcp1
add address=1.1.1.24 client-id=1:d4:ca:6d:9f:88:f mac-address=D4:CA:6D:9F:88:0F \
    server=dhcp1
/ip hotspot
add address-pool=hs-pool-6 disabled=no idle-timeout=15m interface=intern name=\
    Sonnensee profile=hsprof1
/queue simple
add limit-at=4M/4M max-limit=4M/4M name=dsl_queue target=ether1
/queue interface
set ether4/wlan-platz queue=ethernet-default
set ether5/NVR queue=ethernet-default
/routing bgp instance
set default as=100 redistribute-connected=yes redistribute-static=yes \
    router-id=172.18.255.43
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
set 3 remote=10.1.1.1
/interface bridge port
add bridge=intern interface=ether5/NVR
add bridge=intern interface=ether4/wlan-platz
add bridge=intern interface=ether3
add bridge=intern interface=ether2
add bridge=intern interface=wlan1
/ip address
add address=1.1.1.1/24 interface=intern network=1.1.1.0
/ip dhcp-client
add default-route-distance=0 dhcp-options=hostname,clientid disabled=no \
    interface=ether1
/ip dhcp-server lease
add address=1.1.1.29 always-broadcast=yes comment=solar mac-address=\
    00:30:56:A5:B2:3F server=dhcp1
add address=1.1.1.21 client-id=1:0:23:54:7f:73:a7 comment="rechner rezeption" \
    mac-address=00:23:54:7F:73:A7 server=dhcp1
add address=1.1.1.23 client-id=1:bc:ae:c5:bd:37:a0 comment="PC Lager" \
    mac-address=BC:AE:C5:BD:37:A0 server=dhcp1
add address=1.1.1.26 client-id=1:0:1f:1f:75:4a:46 mac-address=00:1F:1F:75:4A:46 \
    server=dhcp1
add address=1.1.1.27 client-id=1:0:f:fe:7c:66:4e mac-address=00:0F:FE:7C:66:4E \
    server=dhcp1
add address=1.1.1.25 always-broadcast=yes client-id=1:b0:65:bd:2d:41:19 \
    mac-address=B0:65:BD:2D:41:19 server=dhcp1
add address=1.1.1.24 client-id=1:d4:ca:6d:9f:88:f mac-address=D4:CA:6D:9F:88:0F \
    server=dhcp1
/ip dhcp-server network
add address=1.1.1.0/24 comment="hotspot network" gateway=1.1.1.1
/ip dns
set allow-remote-requests=yes max-udp-packet-size=512 servers=192.168.2.1
/ip firewall filter
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here"
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" \
    disabled=yes
add action=masquerade chain=srcnat comment="masquerade hotspot network" \
    src-address=1.1.1.0/24 to-addresses=0.0.0.0
add action=redirect chain=dstnat dst-port=80 protocol=tcp to-ports=8080
add action=dst-nat chain=dstnat dst-port=8888 protocol=tcp to-addresses=1.1.1.3 \
    to-ports=80
add action=dst-nat chain=dstnat dst-port=2043 protocol=tcp to-addresses=1.1.1.3 \
    to-ports=8291
add action=dst-nat chain=dstnat dst-port=2047 protocol=tcp to-addresses=1.1.1.7 \
    to-ports=8291
add action=dst-nat chain=dstnat dst-port=2048 protocol=tcp to-addresses=1.1.1.8 \
    to-ports=8291
add action=dst-nat chain=dstnat dst-port=2046 protocol=tcp to-addresses=1.1.1.6 \
    to-ports=8291
add action=dst-nat chain=dstnat dst-port=2045 protocol=tcp to-addresses=1.1.1.5 \
    to-ports=8291
add action=dst-nat chain=dstnat dst-port=2044 protocol=tcp to-addresses=1.1.1.4 \
    to-ports=8291
add action=dst-nat chain=dstnat dst-port=2007 protocol=tcp to-addresses=1.1.1.7 \
    to-ports=8192
/ip hotspot ip-binding
add address=1.1.1.249 comment="AP Cam" mac-address=DC:9F:DB:6C:90:CC server=\
    Sonnensee to-address=1.1.1.249 type=bypassed
add address=1.1.1.29 comment=Solar mac-address=00:30:56:A5:B2:3F server=\
    Sonnensee to-address=1.1.1.29 type=bypassed
add address=1.1.1.37 comment=TEST mac-address=E8:94:F6:02:96:6E server=\
    Sonnensee to-address=1.1.1.237 type=bypassed
add address=1.1.1.250 comment=AirVision mac-address=DC:9F:DB:81:ED:DD server=\
    Sonnensee to-address=1.1.1.250 type=bypassed
add address=1.1.1.4 mac-address=00:0C:42:66:A2:F5 server=Sonnensee to-address=\
    1.1.1.4 type=bypassed
add address=1.1.1.3 mac-address=00:15:6D:C1:9C:CE server=Sonnensee to-address=\
    1.1.1.3 type=bypassed
add address=1.1.1.5 mac-address=00:80:48:7A:C9:54 server=Sonnensee to-address=\
    1.1.1.5 type=bypassed
add address=1.1.1.8 mac-address=D4:CA:6D:C0:8E:57 server=Sonnensee to-address=\
    1.1.1.8 type=bypassed
add address=1.1.1.5 mac-address=00:15:6D:C1:9C:4D server=Sonnensee to-address=\
    1.1.1.5 type=bypassed
add address=1.1.1.20 mac-address=00:80:48:70:4B:21 server=Sonnensee to-address=\
    1.1.1.20 type=bypassed
add address=1.1.1.6 mac-address=00:0C:42:D0:69:4B server=Sonnensee to-address=\
    1.1.1.6 type=bypassed
add address=1.1.1.7 mac-address=D4:CA:6D:9F:88:0E server=Sonnensee to-address=\
    1.1.1.7 type=bypassed
add address=1.1.1.20 mac-address=00:0C:42:AF:CE:D4 server=Sonnensee to-address=\
    1.1.1.20 type=bypassed
add address=1.1.1.6 mac-address=00:0C:42:D0:69:4A server=Sonnensee to-address=\
    1.1.1.6 type=bypassed
add address=1.1.1.7 mac-address=D6:CA:6D:9F:88:13 server=Sonnensee to-address=\
    1.1.1.7 type=bypassed
add address=1.1.1.7 mac-address=D4:CA:6D:9F:88:13 server=Sonnensee to-address=\
    1.1.1.7 type=bypassed
add address=1.1.1.3 mac-address=00:80:48:70:0D:0A server=Sonnensee to-address=\
    1.1.1.3 type=bypassed
/ip hotspot user
add name=admin profile=nolimit
add name=jstrauch
add name=MA01
add name=MA02
add name=MA03
add name=MA04
add name=MA05
add comment=C,Talhorst name=cpsct
/ip proxy
set cache-path=web-proxy1 enabled=yes max-cache-size=none parent-proxy=0.0.0.0
/ip proxy access
add action=deny path=*.mp3
add action=deny path=*.flv
add action=deny path=*.mov
add action=deny dst-host=*porn.*
add action=deny dst-host=*wieist*.*
add action=deny dst-host=*speed*.*
add action=deny path=*.mp4
add action=deny path=*.rm
add action=deny dst-host=*windowsupdate*.*
add action=deny dst-host=*wicon.* redirect-to=1.1.1.1
/ip service
set ftp disabled=yes
set www port=8081
set ssh disabled=yes
set api disabled=yes
/ppp secret
add name=flyconnect
/radius
add address=213.178.69.51 disabled=yes service=hotspot
add address=85.183.140.67 disabled=yes service=login,hotspot timeout=3s
add accounting-port=11813 address=91.250.81.77 authentication-port=11812 \
    service=login,hotspot
/routing bgp network
add network=1.1.1.0/24 synchronize=no
/routing bgp peer
add name=BigBill remote-address=172.18.255.1 remote-as=100 ttl=default
/snmp
set enabled=yes trap-target=0.0.0.0
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Berlin
/system clock manual
set dst-end="mar/28/2017 00:00:00" dst-start="mar/28/2017 00:00:00" time-zone=\
    +01:00
/system identity
set name=Sonnensee
/system leds
set 0 interface=wlan1
/system logging
set 0 disabled=yes topics=info,!wireless
set 1 action=remote disabled=yes prefix=-sonnensee-
set 2 action=remote disabled=yes prefix=-sonnensee-
set 3 action=memory disabled=yes prefix=-sonnensee-
add action=echo disabled=yes topics=hotspot,account
add topics=info
add disabled=yes topics=radius
add topics=error
add topics=warning
add action=echo topics=critical
add disabled=yes topics=wireless
/system ntp client
set enabled=yes primary-ntp=81.89.63.67 secondary-ntp=178.77.126.65
/system scheduler
add interval=5m name=dyndns on-event="/system script run ddns" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\
    feb/22/2017 start-time=09:27:40
add interval=1d name=reboot on-event="/system reboot" policy=reboot,read,write \
    start-date=jul/19/2017 start-time=03:00:00
add disabled=yes interval=5m name=test on-event=\
    "/interface wireless set 0 wds-mode=dynamic\r\
    \n" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=apr/16/2018 start-time=00:00:00
add name=schedule1 policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=apr/16/2018 start-time=21:48:20
/system watchdog
set no-ping-delay=15m watch-address=85.183.140.67 watchdog-timer=no
/tool bandwidth-server
set enabled=no
/tool netwatch
add disabled=yes down-script=":global LinkDown [/system clock get time];\r\
    \n:log warning (\"sani ist down seit : \" . (\$LinkDown));" host=1.1.1.3 \
    timeout=10s up-script=":global LinkDown [/system clock get time];\r\
    \n:log warning (\"sani ist up seit : \" . (\$LinkDown));"
add disabled=yes down-script=":global LinkDown [/system clock get time];\r\
    \n:log warning (\"sani ist down seit : \" . (\$LinkDown));" host=1.1.1.2 \
    timeout=10s up-script=":global LinkDown [/system clock get time];\r\
    \n:log warning (\"biergarten ist up seit : \" . (\$LinkDown));"

The export of other device follows. It is currently not reachable.

9

Export of ohter device 1.1.1.7:

# jun/27/2018 07:24:16 by RouterOS 6.42.2
# software id = HII7-QBG4
#
# model = 751U-2HnD
# serial number = 45E402C71505
/interface bridge
add fast-forward=no mtu=1500 name=intern protocol-mode=none
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=germany disabled=no frequency-mode=superchannel mode=station-bridge radio-name=fewo rx-chains=0 ssid="Sonnensee Biergarten" tx-chains=0 wds-default-bridge=intern wireless-protocol=802.11
add disabled=no keepalive-frames=disabled mac-address=D6:CA:6D:9F:88:13 master-interface=wlan1 multicast-buffering=disabled name=wlan2 ssid="Sonnensee FeWo" wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/interface ethernet switch
set 1 name=switch0
set 2 name=switch0
/interface list
add exclude=dynamic name=discover
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/interface bridge port
add bridge=intern interface=wlan1
add bridge=intern hw=no interface=ether1
add bridge=intern hw=no interface=ether2
add bridge=intern interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=discover
/interface list member
add interface=ether1 list=discover
add interface=ether2 list=discover
add interface=ether3 list=discover
add interface=ether4 list=discover
add interface=ether5 list=discover
add interface=intern list=discover
add interface=wlan2 list=discover
/ip address
add address=1.1.1.7/24 interface=intern network=1.1.1.0
/ip dns
set servers=1.1.1.1,8.8.8.8
/ip proxy
set cache-path=web-proxy1 parent-proxy=0.0.0.0
/ip route
add distance=1 gateway=1.1.1.1
/ip service
set api disabled=yes
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=repeater_fewo
/system leds
set 0 interface=wlan1
/system routerboard settings
set silent-boot=no
/system scheduler
add interval=1d name=reboot on-event="/system reboot" policy=reboot,read,write start-date=jul/19/2017 start-time=03:00:00

Maybe someone with knowledge can see what is wrong.

10

Bridge´s “admin-mac” is 00:00:5E:80:00:04, but it is only shown when I edit the
bridge. Not in /interface bridge print or export, not in the hotspot.

It should be visable in both print and export.

0 R name="Main" mtu=1500 actual-mtu=1500 l2mtu=1598 arp=enabled arp-timeout=auto 
     mac-address=4C:5E:0C:D2:60:B4 protocol-mode=none fast-forward=no 
     igmp-snooping=no auto-mac=no admin-mac=4C:5E:0C:D2:60:B4 ageing-time=5m 
     vlan-filtering=no

And here:

/interface bridge
add fast-forward=no name=Hotspot
add admin-mac=4C:5E:0C:D2:60:B4 auto-mac=no fast-forward=no mtu=1500 name=Main \
    protocol-mode=none

You also have a pool set under IP>Hotspot address-pool, set this to none. it is a Universal NAT helper to allow devices with static IP’s to connect to the Hotspot. it can cause double IP’s, but usually with the same MAC.

11

Thank you 2frogs.
I will correct and test the config, as soon a possible.
Will report about success.

Thanks again.

12

Hi again.
Looks like I am too dumb.
Updated ROS to 6.42.5 (AP) → AP came up with MAC D6:CA:6D:9F:88:0E
Updated FW → device came up with D6:CA:6D:9F:88:13

/int br pr gives me

[admin@repeater_fewo] /interface bridge> print 
Flags: X - disabled, R - running 
 0 R name="intern" mtu=1500 actual-mtu=1500 l2mtu=1598 arp=enabled 
     arp-timeout=auto mac-address=D6:CA:6D:9F:88:13 protocol-mode=none 
     fast-forward=no igmp-snooping=no auto-mac=yes ageing-time=5m 
     vlan-filtering=no 
[admin@repeater_fewo] /interface bridge>

/int br ex gives

[admin@repeater_fewo] /interface bridge> ex     
# jun/28/2018 13:05:07 by RouterOS 6.42.5
# software id = HII7-QBG4
#
# model = 751U-2HnD
# serial number = 45E402C71505
/interface bridge
add fast-forward=no mtu=1500 name=intern protocol-mode=none
/interface bridge port
add bridge=intern interface=wlan1
add bridge=intern hw=no interface=ether1
add bridge=intern hw=no interface=ether2
add bridge=intern interface=wlan2
[admin@repeater_fewo] /interface bridge>

Both without admin-mac.
Same on other device.
Is this a licence level thing ?

13

Do:

/interface bridge set 0 auto-mac=no

As it seems you can not just set admin-mac from terminal. You can set it from winbox also.

14

Looks like “auto-mac=no” solved the whole thing.
Now admin-macs show up in hotspot/hosts.

Thank you 2frogs for your help and patience.