Community discussions

MikroTik App
 
User avatar
otgooneo
Trainer
Trainer
Topic Author
Posts: 576
Joined: Tue Dec 01, 2009 3:24 am
Location: Mongolia
Contact:

Loopguard

Fri Apr 20, 2012 9:32 am

Please add feature that detects loop and does action.Is there anyone with me?
----------------------------
Want to learn more and more...
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24751
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Loopguard

Fri Apr 20, 2012 9:33 am

what kind of loop do you mean? where?
No answer to your question? How to write posts
 
User avatar
otgooneo
Trainer
Trainer
Topic Author
Posts: 576
Joined: Tue Dec 01, 2009 3:24 am
Location: Mongolia
Contact:

Re: Loopguard

Fri Apr 20, 2012 9:37 am

Woow... Normis. You answer like a auto-answer. :D
I mean that I want RouterOS (Maybe only routerboards) detects layer2 network loop. Now RouterOS doesn`t alert or do action when loop occurs. It just tries to process all packets and CPU increases to 100%.
----------------------------
Want to learn more and more...
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24751
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Loopguard

Fri Apr 20, 2012 9:39 am

Already exists. Enable RSTP in all bridges of your network.
No answer to your question? How to write posts
 
User avatar
otgooneo
Trainer
Trainer
Topic Author
Posts: 576
Joined: Tue Dec 01, 2009 3:24 am
Location: Mongolia
Contact:

Re: Loopguard

Fri Apr 20, 2012 9:45 am

Great. What will if I do not use any bridge configuration?
----------------------------
Want to learn more and more...
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24751
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Loopguard

Fri Apr 20, 2012 9:47 am

How can you get a L2 loop then, if you don't use bridge?
No answer to your question? How to write posts
 
User avatar
otgooneo
Trainer
Trainer
Topic Author
Posts: 576
Joined: Tue Dec 01, 2009 3:24 am
Location: Mongolia
Contact:

Re: Loopguard

Fri Apr 20, 2012 10:02 am

Hi Normis. I tried to describe my meaning on the attached picture. Maybe I wrote here wrong. It is physical loop.
You do not have the required permissions to view the files attached to this post.
----------------------------
Want to learn more and more...
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24751
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Loopguard

Fri Apr 20, 2012 10:05 am

You need to choose a HUB that has such feature, Router can't do anything if packets are sent to it. It can just drop them if you like. If you know of some standard that implements functionality you need, let us know.
No answer to your question? How to write posts
 
savage
Forum Guru
Forum Guru
Posts: 1220
Joined: Mon Oct 18, 2004 12:07 am
Location: Cape Town, South Africa
Contact:

Re: Loopguard

Fri Apr 20, 2012 10:09 am

yeppers - get propper switches...
Regards,
Chris
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24751
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Loopguard

Fri Apr 20, 2012 10:11 am

offtopic: savage, change your avatar please. current one only works in your local network, we see message "Connection refused". this has been so forever already. http://home.savage.za.org/lib/images/TN_psd0013.png doesn't work outside your network it seems
No answer to your question? How to write posts
 
savage
Forum Guru
Forum Guru
Posts: 1220
Joined: Mon Oct 18, 2004 12:07 am
Location: Cape Town, South Africa
Contact:

Re: Loopguard

Fri Apr 20, 2012 10:22 am

whoops. ta Normis.
Regards,
Chris
 
User avatar
otgooneo
Trainer
Trainer
Topic Author
Posts: 576
Joined: Tue Dec 01, 2009 3:24 am
Location: Mongolia
Contact:

Re: Loopguard

Fri Apr 20, 2012 10:30 am

How will if I use RB250 (SwOS) with RouterOS? Does SwOS can do this?
----------------------------
Want to learn more and more...
 
kirshteins
MikroTik Support
MikroTik Support
Posts: 592
Joined: Tue Dec 02, 2008 10:55 am

Re: Loopguard

Fri Apr 20, 2012 10:40 am

How will if I use RB250 (SwOS) with RouterOS? Does SwOS can do this?
SwOS has Broadcast Storm Control: http://wiki.mikrotik.com/images/9/9c/Sw ... arding.png. You can limit how many broadcast frames per second will be forwarded by each port (e.g. 1k f/s, 2k f/s etc.).
 
User avatar
otgooneo
Trainer
Trainer
Topic Author
Posts: 576
Joined: Tue Dec 01, 2009 3:24 am
Location: Mongolia
Contact:

Re: Loopguard

Sat Apr 21, 2012 11:54 am

Hi, kirshteins. Good. But please include this feature into RouterOS itself, if possible. Thanks
----------------------------
Want to learn more and more...
 
ginovilla
Member Candidate
Member Candidate
Posts: 121
Joined: Sat Jun 05, 2004 8:02 am

Re: Loopguard

Sun Apr 22, 2012 4:01 am

It would be a very usefull feature apllied to the wireless and ethernet interfaces, would help protect a mikrotik network against customer causing loops by mistakes in their internal network....
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24751
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Loopguard

Mon Apr 23, 2012 8:14 am

Hi, kirshteins. Good. But please include this feature into RouterOS itself, if possible. Thanks
switching happens in hardware, you can't do everything that a hardware switch does, also in software. that's why there are switches! nobody would make switches, if all of the same could be done with software
No answer to your question? How to write posts
 
User avatar
otgooneo
Trainer
Trainer
Topic Author
Posts: 576
Joined: Tue Dec 01, 2009 3:24 am
Location: Mongolia
Contact:

Re: Loopguard

Mon Apr 23, 2012 9:30 am

Thanks normis, understood. :-)
----------------------------
Want to learn more and more...
 
plankanater
Member Candidate
Member Candidate
Posts: 170
Joined: Wed Mar 14, 2012 3:56 am

Re: Loopguard

Tue Nov 20, 2012 4:59 am

Woow... Normis. You answer like a auto-answer. :D
I mean that I want RouterOS (Maybe only routerboards) detects layer2 network loop. Now RouterOS doesn`t alert or do action when loop occurs. It just tries to process all packets and CPU increases to 100%.
Did you ever find a solution to this problem?
 
ludvik
Frequent Visitor
Frequent Visitor
Posts: 65
Joined: Mon May 26, 2008 4:36 pm

Re: Loopguard

Tue Nov 20, 2012 12:59 pm

This "HUB" is maybe user's lowcost switch. There is no real change each device for home users.

This feature is named "loopback-detection" and every better switch have it. This is a protection against trouble users. And every routerboard has switch chip. The outlined situation it is necessary to insert an additional switch that will ensure that protection.
You need to choose a HUB that has such feature, Router can't do anything if packets are sent to it. It can just drop them if you like. If you know of some standard that implements functionality you need, let us know.
 
User avatar
otgooneo
Trainer
Trainer
Topic Author
Posts: 576
Joined: Tue Dec 01, 2009 3:24 am
Location: Mongolia
Contact:

Re: Loopguard

Thu Nov 22, 2012 4:03 am


Did you ever find a solution to this problem?
First I created mangle rule that counts only broadcast packets on each interfaces. Then I made script that checks counted packets of this mangle rule every second. If broadcast packets increases suddenly, script will disable physical interface. It`s like a broadcast storm control :-).
----------------------------
Want to learn more and more...
 
msaeedk36
just joined
Posts: 1
Joined: Fri Apr 12, 2013 9:15 am

Re: Loopguard

Fri Apr 12, 2013 9:18 am

Can you please share that mangle rule and script here..
thnx
 
User avatar
otgooneo
Trainer
Trainer
Topic Author
Posts: 576
Joined: Tue Dec 01, 2009 3:24 am
Location: Mongolia
Contact:

Re: Loopguard

Wed Apr 17, 2013 10:08 am

Can you please share that mangle rule and script here..
thnx
::::MANGLE RULE::::

#Need to add mangle rule on all interfaces
/ip firewall mangle
add action=passthrough chain=input comment=Protectionether1 disabled=no \
    dst-address-type=broadcast in-interface=ether1
add action=passthrough chain=input comment=Protectionether2 disabled=no \
    dst-address-type=broadcast in-interface=ether2
add action=passthrough chain=input comment=Protectionether3 disabled=no \
    dst-address-type=broadcast in-interface=ether3
add action=passthrough chain=input comment=Protectionether4 disabled=no \
    dst-address-type=broadcast in-interface=ether4

::::Detect&Disable_Interface_Script::::

#Run every 1 minutes. Start at 00:00:00
/ip firewall mangle;
:foreach EachMangle in=[find where comment~"Protectionether"] do={
:local PacketStatus1 [get $EachMangle packets];
:delay 1s;
:local PacketStatus2 [get $EachMangle packets];
:local PacketThreshold [($PacketStatus2-$PacketStatus1)];
:if ($PacketThreshold>=4000) do={:local InterfaceName [get $EachMangle in-interface];
/interface ethernet;
:local OldComments [get [find where name=$InterfaceName] comment];
/interface ethernet set [find where name=$InterfaceName] disabled=yes comment="LOOPGUARDED:: $OldComments";
:log error "Loop detected (maybe broadcast storm) on interface, Disabled $InterfaceName"}}

::::Recovery_Interface_Script::::

#Run ever 5 minutes. Start at 00:00:10
/interface ethernet;
:foreach EachEthernet in=[find where comment~"LOOPGUARDED"] do={
:local InterfaceName1 [get $EachEthernet name];
:local OldComments1 [:pick [get $EachEthernet comment] 14 100];
/interface ethernet set $EachEthernet disabled=no comment=$OldComments1;
:log warning "Recovering Loopguarded interface $InterfaceName1"}
----------------------------
Want to learn more and more...
 
User avatar
otgooneo
Trainer
Trainer
Topic Author
Posts: 576
Joined: Tue Dec 01, 2009 3:24 am
Location: Mongolia
Contact:

Re: Loopguard

Wed Apr 17, 2013 10:12 am

I also want to say. It`s not loopguard. It`s just simple broadcast storm protection. As Normis said loopguard can be done on switching chip or Spanning tree protocol of the Bridge.
----------------------------
Want to learn more and more...
 
SPaul
just joined
Posts: 6
Joined: Sun May 11, 2014 1:53 pm

Re: Loopguard

Sun May 11, 2014 2:24 pm

Can you please share that mangle rule and script here..
thnx
::::MANGLE RULE::::

#Need to add mangle rule on all interfaces
/ip firewall mangle
add action=passthrough chain=input comment=Protectionether1 disabled=no \
    dst-address-type=broadcast in-interface=ether1
add action=passthrough chain=input comment=Protectionether2 disabled=no \
    dst-address-type=broadcast in-interface=ether2
add action=passthrough chain=input comment=Protectionether3 disabled=no \
    dst-address-type=broadcast in-interface=ether3
add action=passthrough chain=input comment=Protectionether4 disabled=no \
    dst-address-type=broadcast in-interface=ether4

::::Detect&Disable_Interface_Script::::

#Run every 1 minutes. Start at 00:00:00
/ip firewall mangle;
:foreach EachMangle in=[find where comment~"Protectionether"] do={
:local PacketStatus1 [get $EachMangle packets];
:delay 1s;
:local PacketStatus2 [get $EachMangle packets];
:local PacketThreshold [($PacketStatus2-$PacketStatus1)];
:if ($PacketThreshold>=4000) do={:local InterfaceName [get $EachMangle in-interface];
/interface ethernet;
:local OldComments [get [find where name=$InterfaceName] comment];
/interface ethernet set [find where name=$InterfaceName] disabled=yes comment="LOOPGUARDED:: $OldComments";
:log error "Loop detected (maybe broadcast storm) on interface, Disabled $InterfaceName"}}

::::Recovery_Interface_Script::::

#Run ever 5 minutes. Start at 00:00:10
/interface ethernet;
:foreach EachEthernet in=[find where comment~"LOOPGUARDED"] do={
:local InterfaceName1 [get $EachEthernet name];
:local OldComments1 [:pick [get $EachEthernet comment] 14 100];
/interface ethernet set $EachEthernet disabled=no comment=$OldComments1;
:log warning "Recovering Loopguarded interface $InterfaceName1"}
Hello, thank you for idea(and script). I try to use it on RouterOS 6.5, but seems "dst-address-type=broadcast" not working, nothing to count...
Can you help me with some advice?
Thank you.
 
User avatar
otgooneo
Trainer
Trainer
Topic Author
Posts: 576
Joined: Tue Dec 01, 2009 3:24 am
Location: Mongolia
Contact:

Re: Loopguard

Mon May 12, 2014 9:19 pm

I never tried it on 6.X version. But it should work. Could you please type below commands to post your cfg.
/interface print detail
/ip firewall mangle print detail
----------------------------
Want to learn more and more...
 
SPaul
just joined
Posts: 6
Joined: Sun May 11, 2014 1:53 pm

Re: Loopguard

Tue May 13, 2014 7:49 am

For test use ether4.
3   S name="ether4-slave-local" default-name="ether4" type="ether" mtu=1500 l2mtu=1588 max-l2mtu=4064 mac-address=D4:CA:6D:CD:FF:67 fast-path=yes
0   ;;; Protect_ether4
     chain=input action=passthrough dst-address-type=broadcast in-interface=ether4-slave-local
What i do:
For ssh and web iface connect to ether2.
Make loop on enother switch and connect it to ether4(fast, 1-3 sec).
Nothing...
But when i use /tool sniffer quick
ether2...    17.23  11030 <-                                             192.168.3.125:137 (netbios-ns)      192.168.3.255:137 (netbios-ns)      ip:udp       78
ether2...    17.23  11031 <-                                             192.168.3.125:137 (netbios-ns)      192.168.3.255:137 (netbios-ns)      ip:udp       78
ether2...    17.23  11032 <-                                             192.168.3.125:137 (netbios-ns)      192.168.3.255:137 (netbios-ns)      ip:udp       78
ether2...    17.23  11033 <-                                             192.168.3.125:63777                 224.0.0.252:5355                    ip:udp       50
ether2...    17.23  11034 <-                                             fe80::b560:10a1:b419:877a:63777     ff02::1:3:5355                      ipv6:udp     70
ether2...    17.23  11035 <-                                             fe80::b560:10a1:b419:877a:57710     ff02::1:3:5355                      ipv6:udp     70
ether2...    17.23  11036 <-                                             192.168.3.125:57710                 224.0.0.252:5355                    ip:udp       50
ether2...   17.231  11037 <-                                             fe80::b560:10a1:b419:877a:57087     ff02::1:3:5355                      ipv6:udp     70
ether2...   17.231  11038 <-                                             192.168.3.70:138 (netbios-dgm)      192.168.3.255:138 (netbios-dgm)     ip:udp      221
ether2...   17.231  11039 <-                                             192.168.3.125:137 (netbios-ns)      192.168.3.255:137 (netbios-ns)      ip:udp       78
ether2...   17.231  11040 <-                                             192.168.3.125:137 (netbios-ns)      192.168.3.255:137 (netbios-ns)      ip:udp       78
ether2...   17.231  11041 <-                                             fe80::b560:10a1:b419:877a:58907     ff02::1:3:5355                      ipv6:udp     70
ether2...   17.231  11042 <-                                             192.168.3.125:137 (netbios-ns)      192.168.3.255:137 (netbios-ns)      ip:udp       78
ether2...   17.231  11043 <-                                             192.168.3.70:138 (netbios-dgm)      192.168.3.255:138 (netbios-dgm)     ip:udp      221
ether2...   17.231  11044 <-                                             fe80::b183:f8f:c8e9:65fd:62829      ff02::1:3:5355                      ipv6:udp     70
ether2...   17.231  11045 <-                                             192.168.3.125:137 (netbios-ns)      192.168.3.255:137 (netbios-ns)      ip:udp       78
ether2...   17.231  11046 <-                                             192.168.3.125:137 (netbios-ns)      192.168.3.255:137 (netbios-ns)      ip:udp       78
ether2...   17.231  11047 <-                                             192.168.3.125:137 (netbios-ns)      192.168.3.255:137 (netbios-ns)      ip:udp       78
ether2...   17.231  11048 <-                                             192.168.3.125:137 (netbios-ns)      192.168.3.255:137 (netbios-ns)      ip:udp       78
ether2...   17.231  11049 <-                                             192.168.3.125:63777                 224.0.0.252:5355                    ip:udp       50
(yes, it almost "kill" router and network)
It means another type of packets?
Seems i do(and understand) something wrong...
 
SPaul
just joined
Posts: 6
Joined: Sun May 11, 2014 1:53 pm

Re: Loopguard

Thu May 15, 2014 3:26 pm

Update with new test:
simple marker without filtering
/ip firewall mangle add chain=input action=passthrough comment=loopstorm disabled=no in-interface=ether2-master-local
/ip firewall mangle add chain=input action=passthrough comment=loopstorm disabled=no in-interface=ether6-slave-local
simple script
/ip firewall mangle> :foreach A in=[find comment="loopstorm"] do={:local B1 [get $A packets]; :delay 1s;
:local B2 [get $A packets]; :global TH [($B2-$B1)];
:put [get $A in-interface];:put $B1;:put $B2; :put $TH;}}
shows:
ether6-slave-local
0
0
0
ether2-master-local
8508
8514
6
Why ether6 empty?

And sniffer:
/tool sniffer quick interface=etherX-slave-local
nothing catch, only on ether2-master-local
Please, tell me what i do wrong?
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8493
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Loopguard

Thu May 15, 2014 3:35 pm

Why ether6 empty?

And sniffer:
/tool sniffer quick interface=etherX-slave-local
nothing catch, only on ether2-master-local
Please, tell me what i do wrong?
because slave interfaces use hardware for switching, and CPU does not see any packets from it, all packets go to CPU from master interface
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
User avatar
otgooneo
Trainer
Trainer
Topic Author
Posts: 576
Joined: Tue Dec 01, 2009 3:24 am
Location: Mongolia
Contact:

Re: Loopguard

Fri May 16, 2014 4:59 am

Yes. If u use switching (hardware) feature, that firewall rules don`t work. Try to use Bridging instead of Switching. When u use bridge, don`t forget to check use-ip-firewall=yes or you can implement those mangle rules on filter of Bridge itself.
----------------------------
Want to learn more and more...
 
SPaul
just joined
Posts: 6
Joined: Sun May 11, 2014 1:53 pm

Re: Loopguard

Fri May 16, 2014 7:35 am

Thank you. I try it now.
I will write about the results.
 
User avatar
NetworkPro
Forum Guru
Forum Guru
Posts: 1370
Joined: Mon Jan 05, 2009 6:23 pm
Location: Worldwide
Contact:

Re: Loopguard

Fri May 16, 2014 7:23 pm

Actually CRS crashed and had to be unplugged and plugged back in when I made an L2 loop :)

I had similar problems on a bunch of other routerboard throughout the years :)
wiki.mikrotik.com/wiki/NetworkPro_on_Quality_of_Service
 
SPaul
just joined
Posts: 6
Joined: Sun May 11, 2014 1:53 pm

Re: Loopguard

Thu May 29, 2014 2:58 pm

Not working:(

/interface bridge add name=BR1
/interface bridge port add bridge=BR1 interface=ether24-slave-local
/interface bridge settings set use-ip-firewall=yes
/ip address add address=192.168.11.1/24 interface=ether24-slave-local

Mikrotik-24<-->switch<-->PC_192.168.11.3
Making loop on switch
All pings on PC freezed, Mikrotik freezed...
/tool sniffer quick interface=BR1 still don't catch...

Can you give me more hint?
 
SPaul
just joined
Posts: 6
Joined: Sun May 11, 2014 1:53 pm

Re: Loopguard

Mon Jun 09, 2014 3:12 pm

Hello again...
That is why i can't catch "loopstorm"
 /tool sniffer quick interface=eth24
INTERFACE     TIME    NUM DIR SRC-MAC           DST-MAC           VLAN   SRC-ADDRESS   DST-ADDRESS    PROTOCOL   SIZE
eth24        6.204    155 <-  D4:CA:6D:CD:FF:7B 01:80:C2:00:00:00                                                     802.2        60
eth24         6.21    156 <-  D4:CA:6D:CD:FF:7B 01:80:C2:00:00:00                                                      802.2        60
eth24         6.21    157 <-  D4:CA:6D:CD:FF:7B 01:80:C2:00:00:00                                                      802.2        60
eth24         6.21    158 <-  D4:CA:6D:CD:FF:7B 01:80:C2:00:00:00                                                      802.2        60
eth24         6.21    159 <-  D4:CA:6D:CD:FF:7B 01:80:C2:00:00:00                                                      802.2        60
eth24        6.216    160 <-  D4:CA:6D:CD:FF:7B 01:80:C2:00:00:00                                                      802.2        60
01:80:C2:00:00:00 - MAC looped switch, hundreds packs per second
How mark this?
Maybe another way to check hi-load activity?
 
User avatar
ahmadzai
just joined
Posts: 11
Joined: Wed Sep 02, 2015 8:35 am
Location: Kabul
Contact:

Re: Loopguard

Wed Sep 02, 2015 8:39 am

how can i control broadcast on my mikrotik router plz explain it step by step.
Best Regards

Atiqullah Ahmadzai
Network Technical Manager | Easy Connect ISP
IT (Network, VoIP, WISP, CCTV, Fiber-Optic, Telecom)
Contact: (+) 93 792 99 00 19 / (+) 93 787 45 35 75
Email Add: atiqullah.ahmadzai@easyconnect.af
Skype ID = alu14581
 
User avatar
nirjhar
just joined
Posts: 1
Joined: Wed Nov 19, 2014 10:33 pm
Location: Dhaka, Bangladesh
Contact:

Re: Loopguard

Thu Jan 12, 2017 4:56 pm

So is there any xSTP for Layer2 in MT CRS?
 
sam1275
Member Candidate
Member Candidate
Posts: 110
Joined: Thu May 21, 2015 2:46 pm

Re: Loopguard

Mon Jan 16, 2017 3:00 pm

This is already implied in 6.37.3

Who is online

Users browsing this forum: dioeyandika, roe1974 and 202 guests