I am currently writing a API program for my Blackberry. I see this in most posts about API commands here:
Connecting...
command sent
response received
Disconnecting...

You don't log in, send one command, wait for one response, then log out, do you? I logout only when I am finished with all commands. But I use a thread to open, monitor and close the connection.

so, what's your question?..

yep, normal way is "connect, login, do what you want, disconnect". but in examples on the forum there's frequently just 1-2 commands ))

Thanks Chupaka. That answered it. I like my way better. I can view and edit many sections of the setup with one login.

sure. that's what command tagging was implemented for - you can even execute simultaneous monitoring commands via one connection

Hey Chupaka! I hear you wrote an API script for this OS. Any way you could post the link to that script for me? Doesn't matter what language it is in. I speak many computer languages. I would really like to see it! Maybe some inspiration will come of it. Thanks for all!

all I have is http://forum.mikrotik.com/viewtopic.php?f=9&t=31555 =)

Correct me if I'm wrong, but you cannot close an API session in RouterOS? At least nothing is mentioned in API documentation. I'm mostly using PHP implementation and it only closes socket that has been opened, which in fact doesn't kill the entry in active session list.

Mikrotik responded and said that this bug of sessions not timing out is fixed in ROS v5. Unfortunately I don't think I want to move to v5 for now and I use API queries alot. The problem is that when ROS issues about 100 challenges it responds with "cannot get challenge" error and you can't connect to ROS via API anymore. Reboot being the only way to get it working again is totally out of question for me, so maybe some bright minds could suggest something or at least put worries to an end by telling there's nothing more to do about it?

I really do like working with API, it's very convenient and simple. Since everything is already in place and working as it should (except for that challenge thingy), I don't want to rewrite everything using PHP telnet class. If somehow I could overcome that session overfilling issue, I could get myself a nice vacation

API closes login when you close connection gracefully.

But you are able to issue /quit command to close login, but note that to re-connect again you will have to close connection and create that again to get challenge, so there is no point of using /quit since you will have to close connection anyway.

Use case for API is not to monitor, but to do other things as for monitoring you can use SNMP, for example the Dude

Ok, I shall try /quit'ing after acquiring data or making changes, I don't think this would cause troubles for me as long as that challenge issuing thing doesn't apply. Currently I'm using the PHP API script provided in Mikrotik Wiki. I haven't modified it at all, and it's application doesn't differ much from the example of use provided in that same Wiki page. I don't want to seem annoying, but how do you imagine graceful connection close?

I use API for controlling firewall adress-list entries. The custom web management system is used to enable or disable internet access or create redirects to custom pages for certain customers. I see of no other way of achieving that, with an exception of telnet. My clients often get friendly remainders that they haven't paid yet, and this means they need to press "Continue browsing" button which in turn eventually calls for API script to remove entries from ROS firewall addr-list.

1) The user initiates by telling the TCP to CLOSE the
2) The remote TCP initiates by sending a FIN control signal
3) Both users CLOSE simultaneously


when socket is closed attached API sessions is closed too. (at least it should by design)

I don't know how things are handled past PHP API implementation and I don't think I am qualified enough to dig any deeper. The connection is closed simply by closing the socket with fclose() that has previously been opened with fsockopen(). What else could you do? People are reporting that other implementations doesn't work correctly either, so what needs fixing here?

Btw, /quit doesn't end session in Active session list either.

As mentioned, this is a bug. I don't think there's anything that will fix it other then Mikrotik fixing it in v5. I think v4 will not be fixed.
Also see here for more information: http://forum.mikrotik.com/viewtopic.php?f=9&t=37075

API closes login when you close connection gracefully.

Please define gracefully.

Use case for API is not to monitor, but to do other things as for monitoring you can use SNMP, for example the Dude

What is use case for API?

Monitoring with SNMP.. yes it is doable, but it takes ages to complete to scan one busy MT system.
Yes - you implemented snmp bulk pdu (*cool* ), but only In 5.x which is rc.

Is it so difficult to backport working API from 3.30 or 5.x to 4.x branch, and snmp bulk pdu from 5.x to 4.x ?
Or maybe you have no interest in doing that.

I define gracefully as closing the connection when I am finished. I use Java and a thread to do the communication with the router. That way if the thread stalls, I can recover it with the main program. The main program controls the thread with vectors holding the commands and boolean control bits as "signal lines" between the thread and the program, like a Unix fork and pipe.

My Blackberry does very well at handling the connection. My router shows one login and one logout, no matter how long I stay connected or how many commands I use. The API is easier for a newbie than CLI.

It this graceful enough ? (10.1.1.21 is MT after issuing /quit command)

What versions of ROS do you use ?

How about this for graceful? From my main program: The thread handles the rest.

I use V3.30 and V4.14

ADD: and when the thread has closed the connection, it does this:

Could you paste the tcpdump from your app while closing connection ?

I am not certain I can do a tcpdump from my Blackberry. But why would I need to? The API responds perfectly, and the router shows the login, the correct changes, and a logout. I can log in again right away, do more changes, and logout without exiting the Java program. In the main program: Wait for thread to change Main.Connected=true.

I'm using python API client - slightly modified version of python client example ftom wiki: http://wiki.mikrotik.com/wiki/Manual:API

Mine is a Java version of that script in a way. The "while1" loop is the thread code. But I don't see where that code closes the connection. ??

Code from this example does not close the connection, it just dies when the connection is lost;)
But it's not the point.
I can't logout "grecefully" regardles of logout style.
Logout initiated from mt is useless just the same as initiated from client.

But it's not the point.
I can't logout "grecefully" regardles of logout style.
Logout initiated from mt is useless just the same as initiated from client.

I think it is the point. I don't send "/quit" to my router from the client. I close the connection. Just like the s.connect() in the python code, I have a Java version of s.close(). Immediate logout.

socket.shutdown() doesn't work (does not end the connection 'gracefully' (/user/active is still growing))
mt.talk(['/quit']) doesnt work either.

I'm out of ideas..

There's not much you can do about it. Only possible solutions are to use v5 ROS or reboot your router periodically to clear active API sessions..

I can make persistent API sessions (start a daemon which can hold opened sessions, but it is evil ;> ), but hey - API is about 4 years old it should be mature at this time and it should work as expected for fsck sake!

Well, everything is fine with it, except for that session timeout problem.. But hey, in their new branch of RouterOS it's fixed!. So you can't really blame Mikrotik for not doing anything. You will have to move to v5 eventually, anyway.
I am too struggling with this problem, since I've not yet moved to v5.. And I think it would be best if they would have included a fix for it in their new versions of v4.. Reasons why they didn't are not known: is it something difficult to achieve in v4, or is it their marketing strategy for attracting users to use v5, even if they're perfectly happy with for example v4.

Idea of using a daemon which maintains a single always opened session and accepts queries is actually very interesting, only if someone would have thought about it earlier and made a publicly available daemon This wouldn't eliminate a problem for accessing ROS from mobile devices using API, but at least *nix machines could use API without any limitations. Too bad many people will go to v5 from v4 soon, just as they did a migration from v3 to v4 some time ago..

After checking my V4.14 test router, the logouts (according to the user sessions) were not clean. I am not sure when the session logout problem started because the logins and logouts went smooth in all versions, even V4.14. But since I don't login and logout with every command, it isn't a big deal. I had six open sessions in a month, and three were tests for forum users with questions.

Glad to hear it is fixed in the new version. Mikrotik has been very good about fixing any bugs I have reported. I want to see V5.x debugged so I can use PayPal without the dns cache script I must use now.

BTW, I don't have a problem with my mobile device. My Blackberry phone does a great job of keeping the connection open. One login, a bunch of changes, and one logout. The only inconvenient part was the payment to Research In Motion to use the MD5 encryption in the Blackberry. Maybe someday I will post the code if anyone is interested.

122d uptime

Code: Select all

[admin@MikroTik] > user active print count-only 
53407
[admin@MikroTik] > 

This is one of the things that bothers me. How come you get this number that high and I'm stuck at around 150 with that "challenge error"? What it depends from?

[admin@MikroTik] > user active print count-only
53407
[admin@MikroTik] >

If that is over a period of 122 days, that is an average of 437 logins every day.
I like the thread handling my connection! Six in a month is much better!

FYI: At that rate, it would take me 741 years to get that number.

yep, persistent connections rule, but do you have an experience with v5? for me, rc4 gives timeouts frequently (>100 times a day, with ~500 executions), so I need to reconnect anyway

@Chupaka: I have no experience with V5.x. I am waiting for a stable release. I'm using V4.16 on most routers. The API logout fix is just one of a couple things I am looking forward to. The PayPal walled garden fix is the one that will help me the most!

I noticed you haven't been hanging around the forum as much as you used to. I miss reading your stuff!

there is a problem in RouterOS v4.x that API logins are not closed properly and stay listed in '/user active' there is nothing you or me can do with API client to disconnect/close/leave the router to make them go away.

Code that fixed this problem in 5.0rc broke a lot of things and therefore cannot be safely back-ported to v4.x

on the bright side, active api logins that are hangin' there does not consume resources, at least 100K hanging logins consumed approximately same amount of RAM as no hanging users.

there is a problem in RouterOS v4.x that API logins are not closed properly and stay listed in '/user active' there is nothing you or me can do with API client to disconnect/close/leave the router to make them go away.

In other words: We don't give a f.. , complain to God.

Code that fixed this problem in 5.0rc broke a lot of things and therefore cannot be safely back-ported to v4.x

I dont't want to be rude but... are You kidding me ?
So..split Your big `"broke a lot of things " 4.x to 5.0rc patch`into smaller ones, and backport only the logout routine.

on the bright side, active api logins that are hangin' there does not consume resources, at least 100K hanging logins consumed approximately same amount of RAM as no hanging users.

Sweepping under the carpet ....

I also stumbled upon this problem today. The problem was that Mikrotik (RB1000) mysteriously stopped forwarding some new connections, as if something overflowed inside. TCP connections that were already established worked fine. Everything went back to normal just after reboot. Upon rebooting I saw in the log thousands of messages "user ... logged out from ... via api". Router had about 23 days of uptime and the API connections were made 1-2 times a minute, sometimes more (quick calc gives more than 50.000 active API connections).

Around 3 weeks ago there also was mysterious behaviour fixed by rebooting RB1000. This lack of api logouts is the only symptom I observed.

I'll probably try 5.0rc9 and see what happens.

I hope you'll release final version of 5.0 soon

Hi,

I'm using VB6 and Chillcat Socket component. when I send first /login i got this response

!fatal
not logged in

Any suggestions ?

Thank you

Vaclav Prokes

Don't know about VB, but maybe you should post the login part of your code. Insure you are sending the "end of command" zero character.

You send "/login" by itself (no user or password), then the router should return "!done", followed by the chap challenge. I see it is returning "!fatal", so you are at least communicating with the router, but you seem to have an error in the initial send part of the login.

You should start a new thread. Post the response to this in the new thread. Thanks!

Hi I use this code

Private Sub Form_Load()
Dim socket As New ChilkatSocket

Dim success As Long
success = socket.UnlockComponent("Anything for 30-day trial")
If (success <> 1) Then
MsgBox "Failed to unlock component"
Exit Sub
End If

' Connect to the program at some host:port that is expecting
' to receive the file. In this case, the receiver is at
' localhost:5555
Dim ssl As Long
ssl = 0
Dim maxWaitMillisec As Long
maxWaitMillisec = 1000
'socket.StringCharset = "ascii"
success = socket.Connect("192.168.254.1", 8728, ssl, maxWaitMillisec)
If (success <> 1) Then
MsgBox socket.LastErrorText
Exit Sub
End If

'Set maximum timeouts for reading an writing (in millisec)
socket.MaxReadIdleMs = 1000
socket.MaxSendIdleMs = 1000

' Send the byte count:
success = socket.SendCount(LenB("/login"))
If (success <> 1) Then
MsgBox socket.LastErrorText
Exit Sub
End If

' Send the file data.
success = socket.SendBytes("/login")
If (success <> 1) Then
MsgBox socket.LastErrorText
Exit Sub
End If
DoEvents

' Send zero character
success = socket.SendString(0)
If (success <> 1) Then
MsgBox socket.LastErrorText
Exit Sub
End If

DoEvents

Debug.Print "Response : " & socket.ReceiveString
DoEvents

' Close the connection with the server
' Wait a max of 20 seconds (20000 millsec)
socket.Close 2000
End Sub

It appears you are not sending the zero with "/login". It must be in the same send as "/login".
Normally in higher level languages, the strings are already zero terminated, so I just send one more character than the string length. Try setting the string length to 7 rather than 6. or use something like (LenB("/login") +1)

PLEASE start a new subject!