I have a Mikrotik RB951G-2HnD running RouterOS 6.

I created a switch with port2 as the master and 3,4,5 as slaves. Effectively creating a 4 port switch as I believe is the way to set it up in RouterOS.

The problem is that the switch is acting like a simple network hub, mirroring all traffic from any of the 4 ports to any other port. I was initially trying to setup port mirroring with LAPTOP-A connected to port5 as the source and LAPTOP-B connected to port 2 as the target, which seemed to work, only to find out that when I plugged LAPTOP-A in Port4, I was still seeing the unicast traffic from LAPTOP-A appearing in Wireshark on LAPTOP-B.

The way I tested this is a ping from LAPTOP-A to a particular IPadres, which would otherwise never show up on LAPTOP-B. What is going on here? Why is the switch acting as a hub?

Also, I couldn't remove the source/target mirror ports via the webgui. After removing them and applying, they simply return. I had to go into the CLI and disable them there. After verifying that the mirror source/targe were actually removed, I tested again and I'm still seeing unicast traffic from LAPTOP-A appearing in Wireshark on LAPTOP-B.

This is really doing my head in, how can such a simple feature turn out to cause so much headaches?! :S

I think if what you want is to set up mirror/target port you should take those ports out of the "switch".

I think if what you want is to set up mirror/target port you should take those ports out of the "switch".

The problem is though, that traffic is being mirrored without actually setting a mirror source and target.

Which routeros version? firmware version?

For serious administration I'd use winbox/CLI, try winbox to see if the problem persists when changing parameters.

RouterOS = 6.28
Firmware = 3.22

And Like I said, using the CLI I verified that port mirroring is disabled. I will try Winbox just for the hell of it though.

EDIT: Think you're on the right track though: I restored an earlier backup I made and now the switch and port mirroring is working as expected. Except for the fact that using webfig I still can't remove the port-mirror source/target.

Seems like I'll be going to be diving into the CLI a bit more.

Do yourself a favour and try winbox you'll like it. If you're going to use it often, invest ten minutes reading the Wiki. You can fire a terminal in Winbox also to use the CLI if you like.

Well, just tried Winbox and from there I can successfully disable port-mirror. Too bad the webfig is still a little buggy, because I prefer that as it's more practical and looks just a tad sleeker than Winbox. Oh well.

Thanks for your help!

Well, just tried Winbox and from there I can successfully disable port-mirror. Too bad the webfig is still a little buggy, because I prefer that as it's more practical and looks just a tad sleeker than Winbox. Oh well.

Thanks for your help!

I need mirror traffic to multiple ports. So such hub like behavior is solution.
How port-mirror must be configured to reproduce it?

To multiple ports? What are you trying to achieve?

First review specific switch chip compatibility on http://wiki.mikrotik.com/wiki/Manual:Sw ... p_Features of your specific device, after compat table you have all available features.

I try to mirror to multiple separate security servers (IDS, DLP,...) simultaneously.