MikroTik Router OS V3.0 User Manual

							Packet Sniffer Host
Home menu level:/tool sniffer host
Description
 
  
 
  
 
	
  	
	

 
 	
	 	
 %( 

Property Description
address(read-only: IP address) - IP address of the host
peek-rate(read-only: integerinteger) - the maximum data-rate received/transmitted
rate(read-only: integerinteger) - current data-rate received/transmitted
total(read-only: integerinteger) - total packets received/transmitted
Example
*
 
 
 	 %  
 
  

[admin@MikroTik] tool sniffer host> print# ADDRESS RATE PEEK-RATE TOTAL0 10.0.0.4 0bps/0bps 704bps/0bps 264/01 10.0.0.144 0bps/0bps 6.24kbps/12.2kbps 1092/21282 10.0.0.181 0bps/0bps 12.2kbps/6.24kbps 2994/15983 10.0.0.241 0bps/0bps 1.31kbps/4.85kbps 242/866
[admin@MikroTik] tool sniffer host>
Packet Sniffer Connections
Home menu level:/tool sniffer connection
Description
,  	
 
 	 
  
 



 
	
 	( 
 	
 
 
 

 

Property Description
active(read-only: yes|no) - if yes the find active connections
bytes(read-only: integerinteger) - bytes in the current connection
dst-address(read-only: IP address) - destination address
mss(read-only: integerinteger) - Maximum Segment Size
resends(read-only: integerinteger) - the number of packets resends in the current connection
src-address(read-only: IP address) - source address
Example
 	   
 
 
 
  




Page 460 of 480Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.Other trademarks and registred trademarks mentioned herein are properties of their respective owners. 
						

							[admin@MikroTik] tool sniffer connection> printFlags: A - active# SRC-ADDRESS DST-ADDRESS BYTES RESENDS MSS0 A 10.0.0.241:1839 10.0.0.181:23 (telnet) 6/42 60/0 0/01 A 10.0.0.144:2265 10.0.0.181:22 (ssh) 504/252 504/0 0/0
[admin@MikroTik] tool sniffer connection>
Sniff MAC Address
E 	
 	  
  	
 

	

 +3 +    	
 
 
 
 
  
  



	
 
 	  

	
[admin@MikroTik] tool sniffer> stop[admin@MikroTik] tool sniffer> set interface=bridge1[admin@MikroTik] tool sniffer> start[admin@MikroTik] tool sniffer> printinterface: bridge1only-headers: nomemory-limit: 10file-name:file-limit: 10streaming-enabled: nostreaming-server: 0.0.0.0filter-stream: yesfilter-protocol: ip-onlyfilter-address1: 0.0.0.0/0:0-65535filter-address2: 0.0.0.0/0:0-65535running: yes[admin@MikroTik] tool sniffer>
9  	( 
  	
 

	

 +3 +
[admin@MikroTik] tool sniffer packet> print detail0 time=0 src-mac-address=00:0C:42:03:02:C7 dst-mac-address=00:30:4F:08:3A:E7interface=bridge1 src-address=10.5.8.104:1125dst-address=10.1.0.172:3987 (winbox-tls) protocol=ip ip-protocol=tcpsize=146 ip-packet-size=146 ip-header-size=20 tos=0 identification=5088fragment-offset=0 ttl=126
1 time=0 src-mac-address=00:30:4F:08:3A:E7 dst-mac-address=00:0C:42:03:02:C7interface=bridge1 src-address=10.1.0.172:3987 (winbox-tls)dst-address=10.5.8.104:1125 protocol=ip ip-protocol=tcp size=253ip-packet-size=253 ip-header-size=20 tos=0 identification=41744fragment-offset=0 ttl=64
2 time=0.071 src-mac-address=00:0C:42:03:02:C7dst-mac-address=00:30:4F:08:3A:E7 interface=bridge1src-address=10.5.8.104:1125 dst-address=10.1.0.172:3987 (winbox-tls)protocol=ip ip-protocol=tcp size=40 ip-packet-size=40 ip-header-size=20tos=0 identification=5089 fragment-offset=0 ttl=126
3 time=0.071 src-mac-address=00:30:4F:08:3A:E7dst-mac-address=00:0C:42:03:02:C7 interface=bridge1src-address=10.1.0.172:3987 (winbox-tls) dst-address=10.5.8.104:1125protocol=ip ip-protocol=tcp size=213 ip-packet-size=213 ip-header-size=20tos=0 identification=41745 fragment-offset=0 ttl=64
-- [Q quit|D dump|down]
Page 461 of 480Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.Other trademarks and registred trademarks mentioned herein are properties of their respective owners. 
						

							Ping
Document revision .NaN (February 5, 2008, 15:52 GMT)
This document applies to MikroTik RouterOS V3.0
Table of Contents
TableofContents
GeneralInformation
Summary
Specifications
Description
ThePingCommand
PropertyDescription
Notes
Exampleofpingcommand
ResolveIPaddress:
Ping,usingarprequests:
MACPingServer
PropertyDescription
Example
General Information
Summary
$
  *



 3

 	 $
 &*3$ F 	 
 

  	 
 
  	
(
 
	
( 	
 
 

 
 
7
 	 
 
	

 
 

Specifications
Packages required:system
License required:level1
Home menu level:/, /tool mac-server ping
Standards and Technologies:ICMP
Hardware usage:Not significant
Description
$
 
 *3$  &*3$ 
 C 	 
 
 
 	
 	
  
 *3$ 7 &*3$ 
 .
 
	
 
  

(	 

 
 (

  	 
 
 * 
 
 &
	
  	 

	 

  

 
 
  
 

(	  	 
 	 
 
  
 
	

 		


  

 & 
 A( *  

 	
 	 	
 
  
 	
   
	
  	 
 

	

 
 
 
 

  	
 
	
 
 
  
 

 
 
	
 
 

	


The Ping Command
Page 462 of 480Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.Other trademarks and registred trademarks mentioned herein are properties of their respective owners. 
						

							Command name:/ping
Property Description
(IP addressMAC address) - IP or MAC address for destination host
count(integer; default:0) - how many times ICMP packets will be sent
•0- Ping continues till [Ctrl]+[C] is pressed
do-not-fragment- if added, packets will not be fragmented
interface(name) - ping, using ARP requests on this interface, instead of ICMP requests.
interval(time: 10ms..5s; default:1s) - delay between messages
size(integer: 28..65535; default:64) - size of the IP packet (in bytes, including the IP and ICMP
headers)
src-address(IP address) - Source address for ping
ttl(integer: 1..255; default:255) - time To Live (TTL) value of the ICMP packet
Notes
* 59! (  
 
   
 
  59! 	   
 C
  
( 59! 	 
 
 
  


 ( 
 	 	
 
7 .
E 	


 
 
 	
 	 
	
 
 0  
	
 

	  
 	

B 		 
8	   
	
 0 * %

%  +3 	 
	 	
 2 2 
Resolve IP address:
 ( *$ 	  	 59! 
	 
 
 	

/ping www.google.lv
	
  
 =	> 
[admin@MikroTik] > /ping 66.102.11.104
 59! 
	$$$%%	
 
 *$ 	 GG/.-///.DM
Ping, using arp requests:
Page 463 of 480Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.Other trademarks and registred trademarks mentioned herein are properties of their respective owners. 
						

							 
 	 
 
  	 

 
 +$ 8
 

	  *3$
/ping 10.5.8.130 interface=local10.5.8.130 with hw-addr 00:30:4F:14:AB:58 ping time=1 ms10.5.8.130 with hw-addr 00:30:4F:14:AB:58 ping time=1 ms10.5.8.130 with hw-addr 00:30:4F:14:AB:58 ping time=1 ms3 packets transmitted, 3 packets received, 0% packet lossround-trip min/avg/max = 1/1.0/1 ms[admin@MikroTik] >
MAC Ping Server
Home menu level:/tool mac-server ping
Property Description
enabled(yes | no; default:yes) - whether MAC pings to this router are allowed
Example
 	 +3 

[admin@MikroTik] tool mac-server ping> set enabled=no[admin@MikroTik] tool mac-server ping> printenabled: no[admin@MikroTik] tool mac-server ping>
Page 464 of 480Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.Other trademarks and registred trademarks mentioned herein are properties of their respective owners. 
						

							Torch (Realtime Traffic Monitor)
Document revision 1.9 (January 24, 2008, 15:28 GMT)
This document applies to MikroTik RouterOS V3.0
Table of Contents
TableofContents
GeneralInformation
Summary
Specifications
Description
TheTorchCommand
PropertyDescription
Notes
Example
General Information
Summary
	
 
	 

 	   
 

 
 
	  
 	
 

	
Specifications
Packages required:system
License required:level1
Home menu level:/tool
Standards and Technologies:none
Hardware usage:Not significant
Description
	
 	 

 	 	 
    


 
	 
	
  
 
 	
 

	
E 	
 

 
	 	  
 
	  	 

	

 	 
  

 
  	( 
 	
 	
 
	


 	
 ( 	
	 	
  	  

The Torch Command
Command name:/tool torch
Property Description
(name) - the name of the interface to monitor
dst-address(IP addressnetmask) - destination address and network mask to filter the traffic only
with such an address, any destination address: 0.0.0.0/0
freeze-frame-interval(time) - time in seconds for which the screen output is paused
Page 465 of 480Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.Other trademarks and registred trademarks mentioned herein are properties of their respective owners. 
						

							port(name|integer) - the name or number of the port
protocol(any|any-ip|ddp|egp|encap|ggp|gre|hmp|icmp|idpr-cmtp|igmp|ipencap|ipip|
ipsec-ah|ipsec-esp|iso-tp4|ospf|pup|rdp|rspf|st|tcp|udp|vmtp|xns-idp|xtp) - the name or
number of the protocol
•any- any ethernet or IP protocol
•any-ip- any IP protocol
src-address(IP addressnetmask) - source address and network mask to filter the traffic only with
such an address, any source address: 0.0.0.0/0
Notes
* 
    
 (
 

 

	

   
  
 
	  


	
 


F
 B 	
 B 
   
 
  %(  
 	
 
 
 
 	
% 

&   
53 torch ether1 protocol=any-ipPRO.. TX RXtcp 1.06kbps 608bpsudp 896bps 3.7kbpsicmp 480bps 480bpsospf 0bps 192bps
[admin@MikroTik] tool>
  	
 *$ 
 	 

	

 
!+%+%+%!112&
 


 
 

 !

	
[admin@MikroTik] tool> torch ether1 src-address=10.0.0.144/32 protocol=anyPRO.. SRC-ADDRESS TX RXtcp 10.0.0.144 1.01kbps 608bpsicmp 10.0.0.144 480bps 480bps
[admin@MikroTik] tool>
  	
 
1 
 	 
 
 

 !

	
[admin@MikroTik] tool> torch ether1 protocol=any-ip port=anyPRO.. SRC-PORT DST-PORT TX RXtcp 3430 22 (ssh) 1.06kbps 608bpsudp 2812 1813 (radius-acct) 512bps 2.11kbpstcp 1059 139 (netbios-ssn) 248bps 360bps[admin@MikroTik] tool>
Page 466 of 480Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.Other trademarks and registred trademarks mentioned herein are properties of their respective owners. 
						

							Traceroute
Document revision 1.10 (February 5, 2008, 15:52 GMT)
This document applies to MikroTik RouterOS V3.0
Table of Contents
TableofContents
GeneralInformation
Summary
Specifications
Description
TheTracerouteCommand
PropertyDescription
Notes
Example
General Information
Summary
	
 

  	
 	 
 
 
 	 	
	 

Specifications
Packages required:system
License required:level1
Home menu level:/tool
Standards and Technologies:ICMP,UDP,Traceroute
Hardware usage:Not significant
Description
	
  	 3$1*$ 
7	 

  	  
 

  	
 	 
 


 	 	
	 
 	
   
	
 
 
7
7( (	  	
 	
 
  	

 
 

 
 	 
 (
 

	

 
 	 



 
	  
 	 
  
 
	
  
 
   
 
 (
 
 	  ( 	 	
	 	
 



 	
 
 
 
 	 	 	
	  
  
 

 (	  	 	
	 
 
The Traceroute Command
Command name:/tool traceroute
Property Description
(IP address) - IP address of the host you are tracing the route to
dscp(integer: 0..63) - DSCP field value for the probe packets (in case the route varies depending
Page 467 of 480Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.Other trademarks and registred trademarks mentioned herein are properties of their respective owners. 
						

							on the DSCP priority)
max-hops(integer) - utmost hops through which packet can be reached
port(integer: 0..65535) - UDP port number
protocol(UDP|ICMP) - type of protocol to use. If one fails (for example, it is blocked by a
firewall), try the other
size(integer: 28..1500; default:64) - packet size in bytes
src-address(IP address) - change the source address of the packet
timeout(time: 1s..8s; default:1s) - response waiting timeout, i.e. delay between messages
use-dns(yes|no; default:no) - specifies whether to use DNS server, which can be set in /ip dns
menu
Notes
	
 
 	  
  
 =3
>?=3>
Example
 
	 
 
 
 -/G-:;:;/./ 
 
 *3$ 
 
 	
 2  GD 
 


 5!3$
 
 C 	
 


 
 

 
 D 

[admin@MikroTik] tool> traceroute 216.239.39.101 protocol=icmp size=64 dscp=8timeout=4sADDRESS STATUS1 159.148.60.227 3ms 3ms 3ms2 195.13.173.221 80ms 169ms 14ms3 195.13.173.28 6ms 4ms 4ms4 195.158.240.21 111ms 110ms 110ms5 213.174.71.49 124ms 120ms 129ms6 213.174.71.134 139ms 146ms 135ms7 213.174.70.245 132ms 131ms 136ms8 213.174.70.58 211ms 215ms 215ms9 195.158.229.130 225ms 239ms 0s10 216.32.223.114 283ms 269ms 281ms11 216.32.132.14 267ms 260ms 266ms12 209.185.9.102 296ms 296ms 290ms13 216.109.66.1 288ms 297ms 294ms14 216.109.66.90 297ms 317ms 319ms15 216.239.47.66 137ms 136ms 134ms16 216.239.47.46 135ms 134ms 134ms17 216.239.39.101 134ms 134ms 135ms[admin@MikroTik] tool>
Page 468 of 480Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.Other trademarks and registred trademarks mentioned herein are properties of their respective owners. 
						

							System Watchdog
Document revision 1.3 (February 6, 2008, 4:08 GMT)
This document applies to MikroTik RouterOS V3.0
Table of Contents
TableofContents
Summary
Specifications
HardwareWatchdogManagement
Description
PropertyDescription
Example
General Information
Summary
!
 	
 	
  
 
 
 
 
 
 	  
	 	
Specifications
Packages required:system
License required:level1
Home menu level:/system watchdog
Hardware usage:Not significant
Hardware Watchdog Management
Home menu level:/system watchdog
Description
 
 	 
 
 
 
 	
 *$ 	  

 
  
 	 
 
 	
  !
	 	
 
   
 ( 
 	
 

 
 
 ( 	 	 &	 
		 	


 
 	
    
   	 		 	
 ( 	(		 


) +5 		  	
 
 
 
 
 	
 	
Property Description
auto-send-supout(yes | no; default:no) - after the support output file is automatically generated, it
can be sent by email
automatic-supout(yes | no; default:yes) - when software failure happens, a file named
autosupout.rif is generated automatically. The previous autosupout.rif file is renamed to
autosupout.old.rif
no-ping-delay(time; default:5m) - specifies how long after reboot not to test and ping
Page 469 of 480Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.Other trademarks and registred trademarks mentioned herein are properties of their respective owners.