v7.13rc [testing] is released!

RouterOS version 7.13rc has been released on the “v7 testing” channel!
Before an upgrade:

  1. Remember to make backup/export files before an upgrade and save them on another storage device;
  2. Make sure the device will not lose power during the upgrade process;
  3. Device has enough free storage space to download all RouterOS packages.

Notice - Starting from RouterOS version 7.13, significant changes have been made to the RouterOS wireless packages. This is done due to a new product developemnt which will require more disk space for hardware drivers so we had to split it in order to maintain old products alongside the new ones. More wireless packages are yet to come.

  1. When upgrading by using “check-for-updates”, all versions earlier than 7.12 will display 7.12 as the latest available version. Upgrade from v7.12 to v7.13 or later versions must be done through 7.12 in order to convert wireless packages automatically. Fresh installation with Netinstall or manual package installation works in the same manner as always.

  2. Drivers for older wireless and 60GHz interfaces, as well as the wireless management system CAPsMAN, are now part of a separate “wireless” package instead of being a part of the bundle package. This package can be uninstalled if not needed.

  3. The existing “wifiwave2” package has been divided into distinct packages: “wifi-qcom” and “wifi-qcom-ac”, and the necessary utilities for WiFi management are now included in the RouterOS bundle. RouterOS and “wifi-qcom-ac” packages alongside each other now fit into 16MB flash memory.

What’s new in 7.13rc4 (2023-Dec-12 15:16):
*) certificate - fixed CRL updating;
*) console - improved stability when removing script (introduced in v7.13beta3);
*) defconf - fixed configuration for Audience with “wifi-qcom-ac” package;
*) defconf - improved wifi interface detection after upgrade;
*) ethernet - improved system stability for L009 and hAP ax lite devices;
*) sfp - improved link establishment for SFP copper modules;

What’s new in 7.13rc3 (2023-Dec-06 17:16):
*) console - fixed memory leak (introduced in v7.13beta1);
*) defconf - fixed wireless band and channel-width selection (introduced in v7.12);
*) iot - fixed incorrect LoRa ACK packet handling during downlink messaging (introduced in v7.12);
*) qos-hw - added initial congestion avoidance support for 98DX224S, 98DX226S, and 98DX3236 switch chips (CLI only);
*) sfp - fixed link establishment with S+DA0001 DAC cables;
*) sfp - improved link establishment for SFP copper modules;
*) wireless - keep configuration after manual package removal;

What’s new in 7.13rc2 (2023-Nov-30 17:02):
*) bth - improved automatic firewall rule generation process;
*) certificate - added HTTP redirect support for CRL download;
*) console - fixed user login through RADIUS (introduced in v7.13beta1);
*) console - replace reserved characters in file and script names with underscores;
*) defconf - use “fan-min-speed-percent=25” for CRS354-48P-4S+2Q+ device;
*) ftp - improved upload and download speeds;
*) ospf - fixed missing opaque bit in opaque LSA;
*) ospf - fixed missing OSPF interface on L2TP interface reconnect;
*) qos-hw - added initial congestion avoidance support for 98DX224S, 98DX226S, and 98DX3236 switch chips (CLI only);
*) qsfp - added support for QSFP-to-SFP adapters;
*) ssh-client - fixed bogus output in interactive mode (introduced in v7.13beta3);
*) system - improved incoming and outgoing TCP connection performance;
*) system - improved internal process communication performance;
*) wifi - added “radio-mac” variable for “name-format” provisioning setting;
*) wifi - create first interface without number when using “name-format” provisioning setting;
*) wifi - fixed cap interface hangs with “busy” status (introduced in v7.13beta3);
*) wifi - improved CAPsMAN stability during provisioning;
*) winbox - improved connection speed;

Other changes since v7.12:
!) package - convert “wireless” and “wifi” packages automatically, if upgrading from v7.12;
!) wifi - split existing “wifiwave2” package into separate packages “wifi-qcom”, “wifi-qcom-ac”, and include required utilities for WiFi management into bundle;
!) wireless - separate “wireless” package from bundle and build as a standalone package;
*) bridge - added automatic “path-cost” values depending on interface rate;
*) bridge - added bridge interface property “port-cost-mode” with “short” and “long” arguments;
*) bridge - fixed bogus VLAN entries from wifi when vlan-filtering is not enabled;
*) bridge - fixed HW offload enable with multiple switches (introduced in v7.13beta1);
*) bridge - fixed missing “S” flag after configuration changes (introduced in v7.13beta1);
*) bridge - improved host flush when removing VLAN on HW offloaded bridge;
*) bridge - improved HW offload enable;
*) bth - added “VPN Prefer Relay Code” option;
*) certificate - add support for multiple DNS names for Let’s Encrypt;
*) certificate - added support for certificates with key size 16384;
*) certificate - fixed certificate auto renewal via SCEP when certificate contains “subject-alt-name”;
*) certificate - fixed CRL check (introduced in v7.13beta1);
*) certificate - fixed host certificate verification if host is IP address (introduced in v7.13beta1);
*) certificate - fixed manual URL addition for CRL (introduced in v7.13beta2);
*) certificate - improved CRL signature verification and download error messages;
*) certificate - improved initial certificate creation using SCEP;
*) certificate - use error topic for CRL update failures;
*) cloud - improved re-connect speed after network related connection errors;
*) console - added “:grep” command;
*) console - added “:onerror” command;
*) console - added “:serialize” and “:deserialize” commands for converting values to/from JSON;
*) console - added “interface” name when printing “interface/pppoe-server” entries;
*) console - added “read” command under “file” menu;
*) console - added “where” functionality for “export” command;
*) console - added flags to “print” command with “value-list”;
*) console - added interface helper for “gateway” property under “ip/route” menu;
*) console - added unset option for “ssid-regex” and “allow-signal-out-of-range” properties under “interface/wifi/access-list” menu;
*) console - clear console history when resetting configuration;
*) console - disallow setting existing “name” under “system/script” and “system/scheduler” menus;
*) console - fixed “export” boolean arguments when saving output to file using API;
*) console - fixed “interface/ethernet/switch/port-isolation” export;
*) console - fixed “on-event” argument highlighting under “system/scheduler” menu;
*) console - fixed graphic distortions in WinBox;
*) console - fixed issue where API incorrectly asks for missing arguments;
*) console - fixed misaligned columns (introduced in v7.13beta1);
*) console - fixed missing escaped characters when using print in certain menus (introduced in v7.13beta1);
*) console - fixed printing to file using API;
*) console - ignore negative values for “:delay” command;
*) console - improved flag printing in certain menus;
*) console - improved stability when removing script;
*) console - improved stability when running “tool/ping” from API;
*) console - removed “route-cache” setting from “ip/settings” menu;
*) console - resolve “wifiwave2” directory to “wifi”;
*) console - show “l2vpn-link” address family under “routing/route” menu;
*) console - use more compact login screen for empty branding;
*) defconf - expire password when reverting configuration;
*) defconf - fixed bogus wifi password on certain Audience devices;
*) defconf - hide default configuration for users without “sensitive” policy;
*) defconf - updated configuration with new “wifi” directory;
*) defconf - use “WISP Bridge” default configuration mode for RBGrooveGA-52HPacn device;
*) defconf - use device factory preset credentials when using CAPs mode;
*) defconf - use one SSID and enable FT when using “wifi” packages;
*) disk - fixed hang on reboot when network file systems mounted;
*) ethernet - improved packet CPU core classifier for Alpine CPUs for non IPv4/IPv6 traffic;
*) fetch - added “http-auth-scheme” parameter, allows to select HTTP basic or digest authentication;
*) fetch - added “http-content-encoding” setting;
*) fetch - added raw logging;
*) fetch - allow to receive HTTP response headers;
*) fetch - require “ftp” user policy;
*) firewall - added “nat-pmp” support;
*) firewall - added new IPv6 filter arguments “icmp-err-src-routing-header” and “icmp-headers-too-long” for “reject-with” setting;
*) firewall - do not mark all IPv6 GRE packets as invalid;
*) firewall - fixed altered address-list when upgrading from RouterOS v6;
*) firewall - fixed connections being tracked when tracking is disabled;
*) firewall - fixed IPv6 address-list timeout;
*) firewall - removed “prohibited” and “unreachable” IPv4 address-type arguments;
*) health - dynamically add and remove invalid sensors (e.g. sfp-temperature);
*) hotspot - fixed incorrect host moving to VLAN 0 when receiving packets through bridge;
*) ike2 - fixed ike2 double reply;
*) ipv6 - do not send out IPv6 RA deprecate message for re-used prefix;
*) isis - added IS-IS protocol support (CLI only);
*) l3hw - fixed routing for IPsec encapsulated packets;
*) leds - fixed LED indication in multi-APN setup for Chateau;
*) leds - improved LED indication during modem registration state for Chateau;
*) log - added “fetch” topic;
*) lora - added CUPs protocol support;
*) lora - fixed issue with lost LoRa configuration when rebooting the device;
*) lte - added RNDIS support for neoway N75-EA modem;
*) lte - added support for FOTA firmware upgrade from custom URL for R11eL-FG621-EA;
*) lte - disabled IMS service for Chateau 5G on A1 HR network;
*) lte - fixed rare cases where Chateau 5G in passthrough mode may stop forwarding packets;
*) lte - improved SIM slot status change notification handling for MBIM modems;
*) lte - replaced “passthrough-subnet-selection” with “passthrough-subnet-size” setting (CLI only);
*) lte - show each CA band in a new line;
*) mipsbe - improved system stability when removing USB devices;
*) mmips - properly mount and unmount USB devices;
*) modem - added option to read SMS using MBIM interface;
*) mpls - added “te-tunnel” property for VPLS monitor (CLI only);
*) mpls - fixed IPv6 RSVP-TE;
*) mpls - improved logging;
*) netinstall-cli - added more details to help messages;
*) ospf - fixed LSA Type3 advertisement for OSPFv2;
*) ovpn - improved memory allocation during key-renegotiation;
*) ovpn - removed “ping-timer-rem” option from client config file;
*) package - added warning log about missing “wireless” or “wifi” package;
*) pimsm - improved elected BSR change;
*) poe-out - improved firmware upgrade stability for AF/AT controlled boards;
*) ppc - fixed RouterOS bootup (introduced in v7.12);
*) ppp - added remote-ipv6-prefix to IPv6 firewall address-list if “address-list” property is provided;
*) ppp - allow at-chat and info commands in “waiting for packets” state for modems with shared data/info channel;
*) ppp - improved IPv6 link-local address uniqueness;
*) pppoe-server - fixed connection count limit per license level;
*) profiler - improved “disk” and “supout.rif” classifiers;
*) qsfp - fixed supported rates for breakout cables (introduced in v7.12);
*) quickset - show DDNS name as VPN address for devices with new style serial number;
*) route-filter - improved performance;
*) sfp - added “1G-baseT” link mode for modules that supports “2.5G-baseT” mode;
*) sfp - allow 2.5G rates only in forced link mode;
*) sfp - fixed SFP and combo interface handling for CRS328-4C-20S-4S+ device (introduced in 7.13beta1);
*) sfp - ignore irrelevant extended compliance code for SFP modules;
*) sfp - improved link establishment with certain modules for hEX S device;
*) sfp - improved SFP interface handling for 98DX224S, 98DX226S, 98DX3236, 98DX8208, and 98DX8216 switch chips;
*) sfp - show 10M and 100M supported rates for RJ45 copper modules;
*) ssh - added cipher and hash function acceleration for ARM64 and x86 architectures;
*) ssh - fix error that caused large chunks of text not being pasted in their entirety into console;
*) supout - added multiple WiFi sections;
*) supout - added VXLAN FDB section;
*) supout - include missing wireless information (introduced in v7.13beta1);
*) switch - fixed service VLAN tagged IP multicast packets for 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255 switches;
*) system - added “rtrace” debugging tool (CLI only);
*) traffic-generator - improved system stability when modifying interfaces;
*) usb - added support for RTL8152 USB ethernet on ARM, ARM64 and x86;
*) vpls - improved performance when decapsulating data;
*) vrf - fixed ICMP reply lookup;
*) webfig - allow to display comments in multiline or compact modes;
*) webfig - make table headers always visible;
*) webfig - use local storage for user preferences;
*) wifi - added “flat-snoop” tool for surveying WiFi APs and stations (CLI only);
*) wifi - added “remove” command in “capsman/remote-cap” menu;
*) wifi - after radar detections, avoid selection of channels not permitted by the user;
*) wifi - changed CAPsMAN generated certificate common name;
*) wifi - enable protected interworking ANQP responses;
*) wifi - fixed EAP authentication failures when the Session-Timout RADIUS attribute is defined;
*) wifi - fixed occasional failures to start on 20/40mhz-eC channels for 2.4GHz 802.11ax interfaces;
*) wifi - fixed overridden datapath settings on CAP when unsetting from CAPsMAN;
*) wifi - improved system stability when using sniffer (introduced in v7.13beta1);
*) wifi - make slave APs use datapath bridge settings inherited from master by default;
*) wifi - removed “openflow-switch” setting;
*) wifi-qcom - added fast-path for received packets;
*) winbox - added “Hw. Offload” property under “IP/Firewall/Filter” menu;
*) winbox - added “none” argument for “Preshared Key” under “WireGuard/Peers” menu;
*) winbox - added “Ping” button under “IP/DHCP Server/Leases” menu;
*) winbox - added “Tx bps” and “Rx bps” monitor values under “WiFi/Registration” menu;
*) winbox - added icon to entries under “WiFi/Access List” menu;
*) winbox - added missing “qos-classifier” argument for “Hw. Caps” under “WiFi/Radios” menu;
*) winbox - added missing arguments for “MAC Format” under “Wireless/Security Profiles/RADIUS” menu;
*) winbox - allow opening entries under “WiFi/Registration” menu;
*) winbox - fixed default “Name Format” property under “WiFi/Provisioning” menu;
*) winbox - fixed memory allocation (introduced in v7.13beta2);
*) winbox - fixed minor typo under “Routing/BFD” menu;
*) winbox - updated “wireless” and “wifi” menus;
*) wireless - fixed “wlan1” default name for RBSXTsqG-5acD and RBLDFG-5acD;
*) wireless - fixed snooper information gathering from re-assocation requests;

To upgrade, click “Check for updates” at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

If you experience version related issues, please send a supout file from your router to support@mikrotik.com. File must be generated while a router is not working as suspected or after some problem has appeared on the device

Please keep this forum topic strictly related to this particular RouterOS release.

Please can you confirm if this is the same as 7.13Apha240
And thankyou…

No, not the same. Even better, and includes more fixes!

Upgraded RB5009 from 7.13b1.
It appears upgrade of APs (AX2 and AX3) via capsman manager does not work anymore like it used to be.

Select APs, hit “Upgrade” and nothing happens.
Log file shows an interesting entry:
0xf7f0f460 manual upgrade request failed, no file (wifi-qcom-7.13rc2-arm64.npk)
So I need to foresee that file first on RB5009 …

Logical, when you think about it, but nevertheless something to keep in mind.

Yes, now the rb5009 doesn’t need the qcom package you will have to upload it for the ax APs for auto upgrade to work via capsman

Thanks updated cap ax and ax2

Actually, you ALSO need to upload the base ROS package to that folder or those APs simply disappear from capsman once you got a folder specified.
Even with “none” as upgrade policy.

Filezilla, FTP to RB5009, 2 packages uploaded to folder.
And voila, APs back visible and now I’m able to upgrade them.
Again, there are going to be quite some who will hit this same wall since it is a complete deviation from wave2 devices how it used to work prior 7.13-chain.

The solution is quite simple :slight_smile:
https://git.eworm.de/cgit/routeros-scripts/about/doc/capsman-download-packages.md
I personaly use many of these scripts, they are perfect and very very helpful. :slight_smile:
They are from eworm here in this forum. A very smart guy :wink:
I have the honor to be a beta tester for new scripts or for feature updates.

Have you very smart people any idea what program is doing this, yes this is a pc in laddys room!
Yes I have now disabled SSH

13:19:26 system,error,critical login failure for user  from 192.168.0.188 via ssh
 13:19:26 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:27 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:27 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:27 system,error,critical login failure for user  from 192.168.0.188 via ssh
 13:19:27 system,error,critical login failure for user MikroTikSystem from 192.168.0.188 via ssh
 13:19:27 system,error,critical login failure for user dircreate from 192.168.0.188 via ssh
 13:19:28 system,error,critical login failure for user EServicios from 192.168.0.188 via ssh
 13:19:28 system,error,critical login failure for user SolucTec from 192.168.0.188 via ssh
 13:19:28 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:28 system,error,critical login failure for user root from 192.168.0.188 via ssh
 13:19:28 system,error,critical login failure for user user from 192.168.0.188 via ssh
 13:19:29 system,error,critical login failure for user sysadm from 192.168.0.188 via ssh
 13:19:29 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:29 system,error,critical login failure for user meo from 192.168.0.188 via ssh
 13:19:29 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:29 system,error,critical login failure for user  from 192.168.0.188 via ssh
 13:19:30 system,error,critical login failure for user guest from 192.168.0.188 via ssh
 13:19:30 system,error,critical login failure for user root from 192.168.0.188 via ssh
 13:19:30 system,error,critical login failure for user ubnt from 192.168.0.188 via ssh
 13:19:30 system,error,critical login failure for user Admin from 192.168.0.188 via ssh
 13:19:30 system,error,critical login failure for user root from 192.168.0.188 via ssh
 13:19:30 system,error,critical login failure for user root from 192.168.0.188 via ssh
 13:19:31 system,error,critical login failure for user Admin from 192.168.0.188 via ssh
 13:19:31 system,error,critical login failure for user root from 192.168.0.188 via ssh
 13:19:31 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:31 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:32 system,error,critical login failure for user Administrator from 192.168.0.188 via ssh
 13:19:32 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:32 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:32 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:32 system,error,critical login failure for user vodafone from 192.168.0.188 via ssh
 13:19:32 system,error,critical login failure for user Administrator from 192.168.0.188 via ssh
 13:19:32 system,error,critical login failure for user root from 192.168.0.188 via ssh
 13:19:33 system,error,critical login failure for user webadmin from 192.168.0.188 via ssh
 13:19:33 system,error,critical login failure for user user from 192.168.0.188 via ssh
 13:19:33 system,error,critical login failure for user Admin from 192.168.0.188 via ssh
 13:19:33 system,error,critical login failure for user administrator from 192.168.0.188 via ssh
 13:19:33 system,error,critical login failure for user sysadmin from 192.168.0.188 via ssh
 13:19:34 system,error,critical login failure for user guest from 192.168.0.188 via ssh
 13:19:34 system,error,critical login failure for user manager from 192.168.0.188 via ssh
 13:19:34 system,error,critical login failure for user tech from 192.168.0.188 via ssh
 13:19:34 system,error,critical login failure for user admin2 from 192.168.0.188 via ssh
 13:19:34 system,error,critical login failure for user login from 192.168.0.188 via ssh
 13:19:35 system,error,critical login failure for user admim from 192.168.0.188 via ssh
 13:19:35 system,error,critical login failure for user support from 192.168.0.188 via ssh
 13:19:35 system,error,critical login failure for user root from 192.168.0.188 via ssh
 13:19:35 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:36 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:36 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:36 system,error,critical login failure for user root from 192.168.0.188 via ssh
 13:19:36 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:36 system,error,critical login failure for user admin from 192.168.0.188 via ssh
 13:19:37 system,error,critical login failure for user root from 192.168.0.188 via ssh

Looks for me like some kind of ransonware which has infect the PC…!?

Somebody with IP 192.168.0.188 is trying to guess your router password. Change SSH port, then go and find that person and teach them a lesson

Disconnect and check that PC offline !

Either a bot or some virusscanner trying to get in your router.
The fact it’s trying to use several different user names, makes me think it’s not up to any good.

Yea, could be Virus

He tinkers with programing, I’ll have another Word!
Thankyou

Honestly I think ssh with public key authentication is safer that any other protocol, since you can’t “guess” the key. Whereas you could happen to guess the password.

Google suggests it the AVG virus scanner looking for weak password on the LAN: https://support.avg.com/answers?id=9065p0000000jO6AAI#

Ive had a word, it seems to happen at boot-time 20 secs… so you could be on the money as he does have AVG I believe @Amm0
Thanks will pass on!

Please stick to the topic.

Cap ac, hap ac2 and wap ac + CCR1009-8G-1S-1S+ upgraded fine to this rc. Busy issue is gone and wave2 stability, performance and feature set is now in line whit hardware capabilities, better late than newer. Since first beta I’m testing (carefully whit understanding what I’m doing and having backup plan) ac wave2 in almost 900 students school, we daily have 300-400 STAs connected. WPA3 can and is causing issues, so I recommend starting upgrade whit “legacy security profile” - WPA2 only, MFP off, to be sure and learn how wave2 works as it brings changes.

To summarize my findings: There is no more “graceful disconnect issue”, this was major stability issue, mostly noticeable in larger networks. Performance wise 40mhz channel can push around 140-160mbps under load, tested whit 32 ipads updating at the same time. All STAs that do support 2x2 will connect 2x2, and modulations are holding great (will depend on your env and deployment). Also noticed noticeably lower latency/jitter, network in general is more responsive. Wave2 features (802.11kvrw, beam forming, WPA3 etc) bring even more improvements, mostly noticeable in hi density (again) networks, but also smaller networks will see benefits, especially WPA3. As a feature request I would like to see channel utilization stats in capsman, also be able to collect them whit SNMP, so I can see actual ch usage over time. Also radar detect still needs improvement (Mediatek MT7921au based wifi cards still trigger DFS event almost on every interface toggle, also ax lineup), so for now I cant set Latvia as country, again US works like it should, but incorrect country is causing issues, so not recommended. Rate altering would be great, to cut BPSK and QPSK for example, again, useful in hi dense networks, so I can leave ACL RX limits alone (mostly).

Really happy too see wave2 on ac (arm at least) lineup, it brings a lot of stability, performance and feature improvements. To be clear, till stable is released I don’t recommend updating larger networks if you don’t monitor them and/or don’t have knowledge how to do so, but this brings those device further. They now do work whit the same capsman, so you can mix whit ax lineup, even if you are in transition phase.

Great job boys/girls.

Big thanks to you all for this release, works for me now on my AX gear.

I just upgraded a hEX and cAPacs (with qcom-ac) to RC2. On the beta a configured CAP would show “WAP2-1” and “WAP2-2” with the suffix for the radio interface number as I used provisioning naming as “%I-”. Now it shows “WAP2-” and “WAP2-2” where the 1 suffix is missing for all the WAPs.