Is there any way to see events related to STP such a topology change, blocking a port, etc?
There is a page in the element settings of “/interface bridge filter”, called “STP”. There “stp-flags” parameter can be set. And “action” parameter would be set to “log”. Also the field “log-prefix” can be specified to a some prefix to distinguish messages in the log.
Maybe it will work… I just found it myself, and have not tried yet. I guess it can be problems here with the remote logging (syslog), because bridge interfaces may not work as usual during STP reconfiguration.
Sorry, this way have NOT worked for me till now, unfortunately. The filter rules I had created never matches (in spite the STP topology change packets were present in my network)… I’ve just tried to set this fields in /interface bridge filter item:
chain=forward action=log
dst-mac-address=01:80:C2:00:00:00/FF:FF:FF:FF:FF:FF stp-type=tcn
stp-flags=topology-change log-prefix="STPTopoChange"
I tried different values and all proposed chains (forward, input, output). Tried RouterOS 3.22 and 5.26. Mikrotik bridges are using RSTP algorithm. On reconfiguration I can see by “Wireshark” sniffer STP BPDU packets (0x42 type) with BPDU type 0x80 (I hope it is Topology change notification). But filter rules on routers I’ve created don’t see them and their counters are always zero.
If somebody know how to work with this filter (in bridge firewall), please tell this. Or some other way to log STP and RSTP events.
STP_BPDU_TCN_Packet.txt (2.47 KB)
Searched again, and found similar questions and similar suggestions (like I tried to do):
http://forum.mikrotik.com/t/getting-stp-messages-to-log/48019/1
http://forum.mikrotik.com/t/is-there-anyway-to-sniff-rstp-traffic/55669/5
http://forum.mikrotik.com/t/rstp-logging/18173/1
Either it’s too simple and I’m too dumb (sorry), or there is no way really.
Ok, maybe in fact there is just no real need to catch and log all STP/RSTP TCN packets, as sometimes there can be too much such packets, but how to determine that some line (or tree part) is broken or went down and log this event?
This question is open for me till now… help, please.