There is RB/750G with RouterOS 4.10.
- vlan1 = 10.0.1.2/24
- vlan2 = 10.0.2.2/24
- …
- vlan9 = 10.0.9.2/24
- default gateway = 10.0.1.1 (this is main core Layer3 switch having .1 in all VLAN’s)
- route 10.0.0.0/8 via 10.0.1.1 (for interaction with some remote 10.* networks)
Problem description:
When vlanX-located host (for example, 10.0.5.5/24) does nslookup using DNS 10.0.1.2 (mikrotik IP in vlan1),
response is returned normally, but ARP record on Mikrotik for 10.0.5.5 is not created, and packet sniffer displays nothing.
ICMP(Ping) and TCP(Telnet) are handled correctly, ARP record is created as usual.
Sniffer settings:
/tool sniffer
set file-limit=10 file-name="" filter-address1=10.0.5.5/32:53 filter-address2=\
0.0.0.0/0:0-65535 filter-protocol=ip-only filter-stream=yes interface=all memory-limit=10 \
memory-scroll=no only-headers=yes streaming-enabled=no streaming-server=0.0.0.0
What is the default gateway for 10.0.5.5?
10.0.5.1 (this is layer3 switch having IP *.1/24 in each vlan).
Request path is 10.0.5.5 ==> 10.0.5.1=10.0.1.1 ==> 10.0.1.2
Response path must be 10.0.1.2=10.0.5.2 ==> 10.0.5.5
Well, why the should be ARP about this client on 10.0.1.0 network?
MikroTik RouterOS should see 10.0.5.1 address/mac-address as 10.0.1.1 in ARP table, 10.0.5.1 is layer3 switch.
No, Mikrotik should see 10.0.5.5 on vlan5 interface, because sends answers directly from 10.0.5.2 (his IP in vlan5).
I do not know the entire configuration of your router, previously there was no information about the 10.0.5.2 as address of the router.
As well there could be bridge on your router and packets can go through the bridge (not to the router), then ARP entries are not added to the /ip arp table.
May be this picture will clarify situation for you:
(1) is the path of request from client to 10.0.1.2 via l3 switch.
(2) should be a path of response.
On my routerboard, (2) happens for TCP and ICMP, but not for UDP:
on Mikrotik, ARP table for vlan5 still empty, packet sniffer on vlan5 displays nothing.
isn’t it possible that packet is sent back via vlan1? try to sniff on all interfaces to see exact path of the packet…
Step 1. Configure sniffer on Mikrotik (vlan1:10.0.1.2/24, vlan5:10.0.5.2/24):
/tool sniffer
set file-limit=10 file-name="" filter-address1=10.0.5.5/32:53 filter-address2=\
0.0.0.0/0:0-65535 filter-protocol=ip-only filter-stream=yes interface=all memory-limit=10 \
memory-scroll=no only-headers=yes streaming-enabled=no streaming-server=0.0.0.0
Step 2. Inspire UDP request from client (10.0.5.5/24) and receive correct answer:
C:\> nslookup www.r0.ru 10.0.1.2
Server: ns.our.lan
Address: 10.0.1.2
Non-authoritative answer:
Name: www.r0.ru
Address: 81.19.70.4
Step 3. Check sniffed packets and ARP table on Mikrotik and get asshole:
[admin@MikroTik] > /tool sniffer packet print
# TIME INTERFACE SRC-ADDRESS
[admin@MikroTik] > /ip arp print where interface=vlan5
Flags: X - disabled, I - invalid, H - DHCP, D - dynamic
# ADDRESS MAC-ADDRESS INTERFACE
[admin@MikroTik] >
Step 4. Inspire ICMP request from the same client:
C:\> ping 10.0.1.2
...4 requests, 4 answers...
Step 5. Check sniffed packets and ARP table on Mikrotik and get smthing that seems correct:
[admin@MikroTik] > /tool sniffer packet print
# TIME INTERFACE SRC-ADDRESS
0 34.318 vlan1 10.0.5.5
1 34.327 vlan5 10.0.1.2
2 35.318 vlan1 10.0.5.5
3 35.319 vlan5 10.0.1.2
4 36.319 vlan1 10.0.5.5
5 36.319 vlan5 10.0.1.2
6 37.319 vlan1 10.0.5.5
7 37.319 vlan5 10.0.1.2
[admin@MikroTik] > /ip arp pr where interface=vlan5
Flags: X - disabled, I - invalid, H - DHCP, D - dynamic
# ADDRESS MAC-ADDRESS INTERFACE
18 D 10.0.5.5 00:31:58:46:14:A5 vlan5
[admin@MikroTik] >
oh, you should use
filter-address1=10.0.1.2/32:53
source port is not 53
Great!
Changing filter1 to 10.0.5.5/32:0-65535 causes following results (after “nslookup r0.ru 10.0.1.2” on client):
[admin@MikroTik] > /tool sniffer packet print
# TIME INTERFACE SRC-ADDRESS
0 8.258 vlan1 10.0.5.5:3738
1 8.264 vlan1 10.0.1.2:53 (dns)
2 8.264 vlan1 10.0.5.5:3739
3 8.266 vlan1 10.0.1.2:53 (dns)
But why Mikrotik sends UDP (and only UDP, no such problem for ICMP and TCP!) responses to 10.0.5.* via vlan1 instead of vlan5?
probably it’s just implementation feature. AFAIR, NTP server works the way you describe - it can even send responses from another src-address %)
It’s very strange… All other OS’es (Linux, FreeBSD, …) works in another manner - send responses using shortest path.
hm… I wonder, what is dst-mac-address of the response packet?.. where does router sends it?..
How to check it? Using /ip tool sniffer + remote Wireshark?
I hope that dst-mac = MAC of layer3 switch, because it’s the only way to deliver responses (except direct sending via vlan5, of course).
packet sniffer shows also MAC addresses