I've got lost when you've stated the following:

If I leave the MT configured for DHCP and have the static settings on my laptop and do the test I get the reduced bandwidth.

I don't get how this can work at all - do "the static settings" mean the static public address you've got assigned by the ISP? If so, what's the rest of the configuration, and how does a packet coming from the internet to that address even make it to the WAN of the Mikrotik, given that the Mikrotik doesn't respond to an ARP request for that address?

I was hoping that someone who at least has a clue what Charter Cable means will react, but as no one seems to, let's start from the export of the configuration of the 3011 in the state when it is configured the actually intended way (which I understand to be the static public IP on the WAN of the 3011). See my automatic signature below regarding proper anonymisation - in this strange case, it is really important that the relationship between the static public IP and the gateway configuration is not broken by the anonymisation, so use only the first two bytes of the public IP when doing the find&replace.

In any case it is not normal that a 3011 would give such a poor routing performance.

While this is going on I configured my laptop for the static IP address information and plugged into a second port on the modem outside the Mikrotik and did the speed test.

OK, so this was the part I did not get properly. In this case, the 3011 was not inserted into the path between the modem and the laptop but was connected alongside to the laptop.

If I unplug the MT from the modem and do the speed test everything is fine. I did this test thinking perhaps it's something behind the MT that is consuming bandwidth, however a dynamic client behind the MT doing a speed test gets the full speed.

Is the laptop configured with a gateway IP or is just the interface set up as the gateway of the default route (if it is a Windows laptop, this question is irrelevant)?

Is the modem in bridge mode or does it work as a router?

Have you tried the reverse test, running the speed test on a dynamic client behind the MT while the laptop with the static public IP was also connected to the modem (not running a speedtest too, just being connected alongside)?

One unpleasant explanation would be that some malware lives in the 3011, clever enough to exhaust the available bandwidth but give priority to LAN traffic to remain unnoticed.

Hmm... how is it irrelevant if it's Windows?

On other operating systems than Windows you can specify just the interface as a gateway even on multipoint interfaces like Ethernet, and the IP stack learns the actual router (gateway device) from the ICMP advertisements sent by routers in the subnet. So it could be that the modem advertises itself as a router, and if it is the only one, everything runs smooth; if the Mikrotik is there as well, it may advertise itself too and cause some confusion. The only problem here is I have never noticed Mikrotik to send those ICMP advertisements. But since it is a Windows machine and you've configured the gateway as an IP address, that cannot be it.

I am guessing that it is a router since on the other ports it's handing out private IP addresses and running NAT on them. I'm not even sure you can do bridge mode with a cable provider can you? At least with these guys they always give you a single IP /30 subnet or /29 if you're getting a larger subnet like our church has.

Forget that - I forgot about the DHCP when thinking what may possibly go wrong with the public subnet.

Have you tried the reverse test, running the speed test on a dynamic client behind the MT while the laptop with the static public IP was also connected to the modem (not running a speedtest too, just being connected alongside)?

I have not tried this... what app could I run on a Windows machine to accomplish this.. I would assume the speedtest would use the built-in speed testing capability of the MT?

I'm not sure I get you now. You use some application (or a script on a web page) to do the speedtest on the laptop, and I've supposed you use the same app/web page on some other laptop connected to the 3011 while the 3011 is a DHCP client at its WAN. So I suggest this test merely to see whether the problem are any two devices connected to the modem's LAN or the 3011 in particular (adding the 3011 alongside the laptop ruins the speedtest on the laptop with the public IP, so maybe adding the laptop with public IP ruins the speedtest running on the device behind the 3011 too).

The speedtesting capability of RouterOS is not compatible with the common TCP download/TCP upload speedtests like the ookla (speedtest.net) one, you need two Mikrotiks to test against each other, so it's not relevant for this case.

One unpleasant explanation would be that some malware lives in the 3011, clever enough to exhaust the available bandwidth but give priority to LAN traffic to remain unnoticed.

I did at one point completely wipe out the router and reconfigure it to test... also upgrading to a new version of the OS. I'm not sure if malware would survive that or not. It would have to be really clever I would think - not to say that it couldn't be easily reinstalled if it was an un-fixed exploit.

The only sure thing is a netinstall as it wipes the flash completely. Some malware can survive configuration erasure and possibly even RouterOS upgrade.


If I were on site, I would capture the LAN using Wireshark on the laptop with the public IP with and without the Mikrotik connected, and I'd also mirror the WAN port of the Mikrotik to an unused port on the same switch chip and sniff on it using Wireshark on another laptop while the speedtest would be running on the laptop with the public IP, simultaneously with sniffing on the latter, to see what's going on at both. Either there is additional traffic from the internet exhausting the bandwidth, or some broadcast flood blocking the modem's LAN, or some MAC address conflict causing part of the traffic not to reach the laptop with public IP. I cannot imagine anything else as of now.

Not sure how I would do that in reverse as you suggest. I do have other Mikrotik routers which I could use as an internal client for a speedtest but then it wouldn't be apples to apples.

Well, it seemed more likely to me you would have another laptop than that you would have another Mikrotik 🙂 To capture simultaneously at the laptop with public IP and at the mirrored WAN of the 3011, you'll need another laptop anyway (unless you have a second network card on your single laptop, an USB3.0 network dongle should be sufficient).


I also don't know what the simultaneous capturing will show. I've suggested some possibilities what could be the cause, so I'd be looking for them at first - too much extra traffic drained by the Mikrotik, or too few packets reaching the laptop and packets with the public IP as destination appearing at the Mikrotik's WAN.

If you get lost, you can always decide to share the sniffed files (there are ways to exchange contact information via this forum privately although private messaging has been disabled again).

I do also have an additional USB dongle but it's 100Mbit. Laptop would probably be better...

Yes, another laptop is definitely a better choice.

How do I go about setting up the port mirror to another switch port?

Assuming your uplink port is ether10 and you want to mirror it to ether9:

• make the ether9 free of any configuration - it must not be a member port of any bridge or bond, no /interface vlan rows must refer to it, no IP configuration (address, dhcp client, dhcp server) must refer to it. You don't need to remove such configuration items, it is enough to disable them.
• then, do the following:
  /interface ethernet switch set switch2 mirror-source=ether10 mirror-target=ether9

As both directions of traffic on ether10 are mirrored to the same destination port (the switch chip is relatively simple), you can't push the full 1 Gbit/s bandwidth through ether10 as ether9 would have to send out 2 Gbit/s which is not possible, but I suppose you don't have a gigabit uplink.

Intermediate issues are the worst ones to find. @jvanhambelgium suggests to check interface statistics on the 3011, but as you say that even connection of the 3011 to the modem affects the performance of the laptop connected directly to the modem, it would be even more useful to check such statistics on the modem. I can e.g. imagine an ill-soldered contact of the modem's Ethernet connector, where vibration makes the connection drop completely or renegotiate to 10 Mbit/s half duplex, and by connecting the 3011, you create a mechanic tension which moves that ill-soldered contact to a position where this happens. But that's just another theory which has to be confirmed or denied by the sniffing.

Do you use Discord?

I use several communication platforms but not discord. However, the key is that I don't want to disclose my contact information to everyone on the forum and you probably also don't want to publish yours. If so, you may use the suggestion in this post to send me your e-mail or phone number encrypted via a post here.

Sorry, I've found out I don't have the private key to that public one any more :(

One more try, please.

public key code

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArauOfFEn3Grb2WhnlKe1
hEG9bwq+7fJiDhFyCK+CcmXwQyGWl4LIop5VCTNUYq/++PSFOAmkoLA1+TMTAN6s
f7ukyVErCxpfUMy+xhutVzsVDHIaAScJFr3QUPmI+544EMplZn70DOWIWgv4Xtac
jeiuqJZ2mExt/8amZTQ2dJ3MHmRaD20gUI+ByJwkQopxUZTOfKAXkhkL/HTcksyO
ORSh+EzFN+ll674084RpbXGKnaDYysAObLSib9UgnHnQ98WLbh+4XZqDc6T82mFW
0BcxLI8pUeITwBaexX8YbDYOFnxskLIlGcRb0F9sRGV8as4H5+zuwlO14K1LDb4Y
suNttQSKYFOZ91G2SOBlGiejO2xf7t3spdv0LurOkvvKJo+wOwAhfz/8zBubUBqd
0jXQyzkQ+WkBMzKBYwOl39YQXUHYHxxGUXMupslSyw1qcyW0QeC91hfM+/GNk+j/
+w+lqLV0So2gc8vD/9mVAcMv9g8eSffvwEKygnXsqlg4QLvjCVNu1TMtYH9NJAgs
2VoBgDaAZrc5id9dk41Zh19L4mYJ+uTiafZ/g/5jx5AEjPdVcsKBsatQVld+RuS5
B+kLTXbPuk8kXRLhKuSOEEBGOvXaCvwqNPdvghNOQSvydVOkVyS6/SL5I0UWOg8s
2B5HsHfn4Ph9gjxDMmiUl1UCAwEAAQ==
-----END PUBLIC KEY-----

Just for the case, you should have a message from me in your inbox.

Received it, downloading the file.

Just checking whether you've received my e-mail response yesterday, with comments on the file contents.