Quite a simple setup.
Tet router - Alcatel-lucent connected to two ports on RB850Gx2. One connection for iTV, another for internet.
Traffic is tagged as vlan6 for TV and vlan7 for local network (NATed to internet) 1G network connection, trunk, to hEX PoE, where traffic is untagged and Motorlla decoder is connected to one access port, and local clients to others.
Everything works great except TV picture is freezing frequently, sound is fine, but picture is slideshowing.
Any ideas what can be wrong with this setup and what to do to get ir running? Any help will be appreciated.
RouterOS on both MT v6.45.3, CPU on about 4% and other resources looks enough. Traffic on TV interfaces is something about 6-7Mbps, perhaps it should be enough. No errors un links.

Config, RB850Gx2:

hEX:

Hoi

The network is unclear, could you post a diagram?

Sorry, I'm not good with drawings, but here is something: hope this helps.
TV top box is supposed to be connected directly to tet box, when it is, everything works smoothly. Connection between MT routers is 1G, tv box never negotiates faster than 100M so I suppose it has 100M interface or is set not to negotiate faster. Have no control over it.
Lan clients can be connected to either MT router, it dosen't matter and works smoothly.
RB850Gx2 dose all the stuff like NAT, CAPsMAN and everything. It has no address on vlan6 (TV) just a bridge to vlan6 and dedicated ethernet port for TV. Same on other side - only bridge and dedicated port.
As you can see from config - there is IGMP snooping enabled on iTV bridge.
Maybe there is something about MTU?

Your configuration prints don't show any /interface ethernet switch settings and you handle the VLAN tagging and untagging using a dedicated bridge for each VLAN, which means that the IPTV traffic is handled by the CPU. So have a look at /tool profile at both your Tik machines while watching TV, at least one of them will probably have a tough time.

The right way to do that is to use a common bridge for both VLANs at both machines, with so-called "hardware offloading" enabled in /interface bridge port, and handling the tagging and untagging using the /interface ethernet switch branch of the configuration tree. In this case, the frames from the Tet blackbox to the STB will bypass the CPU completely at both routers.

Thanks for answer, I have checked load on both routers, it is near idle while watching TV. For example CPU usage never gets higher than 5%. I suppose this is not an issue.
Perhaps I can try to rebuild setup like you say, only have to understand how to make proper config

I have checked load on both routers, it is near idle while watching TV. For example CPU usage never gets higher than 5%. I suppose this is not an issue.

That's quite surprising, but as you say that sound is unaffected and only the video became an SSTV one, it seems as if there was no packet loss all the time but rather as if the source of the TV packets has switched over to reduced frame rate once it has detected packet loss when trying with a regular frame rate first.

The setup with hardware acceleration requires that both the "TV" and "LAN" VLANs (6 and 7, respectively) are tagged on the common bridge. So post the export of both Tiks' configurations following the hint in my automatic signature below, and we can do the necessary modifications to both without (hopefully) getting locked out and having to use a serial port to re-gain access.

OK I have attached exports of both units.

If you don't insist that the LAN goes tagged between the Tiks, it might be much easier to handle the ITV VLAN by switch chips. The point is that the switch chip can tag frames on ingress but not on egress, so to have VLAN 7 frames tagged at ether1, they have to get tagged already at ether2..ether4 as they enter the switch, which means that you need an /interface vlan vlan-id=7 interface=LAN to get them untagged internally for L3 processing. So you would lose management access to the device while doing this change. One possible way around this is to remove one of ether2..ether4 from the bridge, attach a non-conflicting private address and subnet to it and use it for management while reconfiguring the rest. Another way is to use a serial cable if you have one, but that leaves you with just the command line so if you are not fluent in it, I'd avoid this option. And the last way is to keep the LAN as untagged on all ports including ether1. What is your choice?

It dosen't matter much to have tagged all internal traffic, main goal is to isolate traffic, so that TV provider can't see anything what happens locally, and vice versa. Of course in most stable way
I can free one ethernet port and set up unique IP while changing config without problems. I can connect trough internet as well (ether5).
Unfortunately I don't have serial cable.

OK, so let's take the way with tagless LAN between the Tiks, I hope it will work. But do every step with safe mode on; if you don't get locked out during 30 seconds after the change, disable and re-enable safe mode to store the progress gained so far and be safe for the next step. If you get locked out, just wait for a minute and log in again.

Starting from the 850.

First define the two VLANs on the switch chip:
/interface ethernet switch vlan
add switch=switch1 vlan-id=1 ports=ether1,ether2,ether3,ether4,switch1-cpu
add switch=switch1 vlan-id=6 ports=ether1,ether4

Next, set up the port default vlan IDs:
/interface ethernet switch port
set ether1,ether2,ether3,switch1-cpu default-vlan-id=1
set ether4 default-vlan-id=6

Now this is the step which may lock you out:
/interface ethernet port
set ether1,ether2,ether3,ether4 vlan-mode=secure

If you survive until here, remove both /interface vlan from their respective bridges first and then remove them completely, then make ether1 a member of bridge LAN, and make ether 4 also a member of bridge LAN rather than of bridge ITV. Finally, remove bridge ITV.

At this stage, /interface bridge port print should show you the H indicator for ether1..ether4, indicating the "hardware acceleration" to be active. If so, we can move on to the 960, where the steps will be similar:

First define the two VLANs on the switch chip:
/interface ethernet switch vlan
add switch=switch1 vlan-id=1 ports=ether1,ether2,ether3,ether5,switch1-cpu
add switch=switch1 vlan-id=6 ports=ether5,ether4

Next, set up the port default vlan IDs:
/interface ethernet switch port
set ether1,ether2,ether3,ether5,switch1-cpu default-vlan-id=1
set ether4 default-vlan-id=6

Now this is the step which may lock you out:
/interface ethernet port
set ether1,ether2,ether3,ether4,ether5 vlan-mode=secure

If you survive until here, remove both /interface vlan from their respective bridges first and then remove them completely, then make ether5 a member of bridge LAN, and make ether 4 also a member of bridge LAN rather than of bridge ITV. Finally, remove bridge ITV.

Like on the 850, /interface bridge port print should show you the H indicator for ether1..ether5, indicating the "hardware acceleration" to be active.

Thank you very much, sindy
Looks like everything went smoothly and goal has been achieved - TV works as supposed. And local traffics performance is good.

As I'm not familiar with this setup, could you please explain me one last thing - how can I know the traffic is really isolated - there is no crosstrafiic possible?
If I run torch on different interfaces I can see only local addresses or nothing.

Thanks again

When vlan-mode on switch port is set to secure, frames tagged for VLANs which are not permitted on that port are dropped at ingress. So on all ports of the switch except the CPU one and the one used for connection with the other Tik, either only the LAN frames or only the ITV frames can get in. Only on the interconnection port, both VLANs are permitted; on the CPU port, all VLANs are permitted to enter the switch. As the ITV VLAN is only permitted at ether1 and ether4 at the 850 end, the ITV frames from the blackbox cannot get to the CPU; similarly at the set-top box end. If you added an /interface vlan vlan-id=6 interface=LAN on the 850, the CPU would be able to send packets to VLAN 6 (as the vlan-mode of the cpu port of the switch is disabled), but not receive them from there. Same case at the 960. So the ITV traffic knows nothing about the LAN one and vice versa. External devices connected to the LAN ports may send frames tagged with VID 6 but as this VLAN is not permitted on other ports than ether4 and ether1 (at the 850) or than ether4 and ether5 (at the 960), they cannot affect the ITV operation.

/tool sniffer and /tool torch don't work well when hardware switching is used - if you try sniffing at ether4, you should see nothing as the vlan-mode and vlan port lists should prevent the ITV frames from reaching the CPU where the sniffing actually takes place.

OK, that's clear
Thanks again