Netmon Docs · Device Configuration Guide

MikroTik RouterOSv7.0.20

Configure MikroTik routers and switches on RouterOS to mirror traffic using switch-chip port mirroring and export flow data with Traffic Flow (NetFlow/IPFIX).

Covers MikroTik routers and switches running RouterOS (v6 and v7), configured from the RouterOS CLI (the same command paths apply in WinBox/WebFig).

Mirror traffic (SPAN)

RouterOS port mirroring is a switch-chip feature only: the mirror is performed in hardware by the on-board switch chip, so both the source and target ports must belong to the same switch chip, and the mirror target must be a physical port. There is no software/RSPAN equivalent and no mirroring of bridge or routed interfaces in software. Devices without a supported switch chip cannot mirror at all.

  1. Identify which switch chip your ports belong to (the source port you want to copy and the target port wired to the Netmon sniffer NIC must be on the same switch). 
    [admin@MikroTik] > /interface ethernet print
  2. Set the mirror source and mirror target on that switch object. Mirrored ingress and egress traffic from <source-port> is sent to <target-port>. 
    [admin@MikroTik] > /interface ethernet switch set switch1 mirror-source=<source-port> mirror-target=<target-port>
  3. Connect <target-port> to the Netmon NIC that is set to Sniffer (manual). See Receiving the Data in Netmon.
Note

The switch object name varies by model (for example switch1). Run /interface ethernet switch print to list the switch objects on your device, and confirm in /interface ethernet that the source and target ports belong to the same switch.

Important

mirror-target must be a single physical port on the same switch chip as mirror-source. Port mirroring is only available on devices with a supported switch chip; models without one cannot perform SPAN. (A special mirror-target=cpu value sends mirrored packets to the switch chip’s CPU port and is not used for feeding an external collector.)

Source: Switch Chip Features — RouterOS — MikroTik Documentation. https://help.mikrotik.com/docs/spaces/ROS/pages/15302988/Switch+Chip+Features

Export flow data

RouterOS exports flow data with Traffic Flow, which is compatible with Cisco NetFlow. RouterOS supports NetFlow versions 1, 5, and 9, and IPFIX (v10). It does not export NetFlow v7 or v8, and RouterOS has no sFlow support at all — the NetFlow/IPFIX path below is the only option.

The RouterOS documentation default target port is UDP 2055; override it to 9996 so it points at Netmon’s collector.

  1. Enable Traffic Flow and select the interfaces to gather statistics from (all, or a comma-separated list). 
    [admin@MikroTik] > /ip traffic-flow set enabled=yes interfaces=all
  2. Add a target pointing at the Netmon appliance. Use UDP port 9996 and version=9 (use version=1, version=5, or version=ipfix if you prefer another supported format). 
    [admin@MikroTik] > /ip traffic-flow target add dst-address=<netmon-ip> port=9996 version=9
  3. (Recommended) Set the exporter source address so the flows arrive from the address Netmon knows the device by. 
    [admin@MikroTik] > /ip traffic-flow target set [find dst-address=<netmon-ip>] src-address=<device-source-ip>
  4. Verify the configuration. 
    [admin@MikroTik] > /ip traffic-flow print
[admin@MikroTik] > /ip traffic-flow target print

On the Netmon side, enable Allow Netflow Data Collection for this device — see Receiving the Data in Netmon.

Note

NetFlow v9 and IPFIX are template-based: the router periodically resends the template (controlled by v9-template-refresh / v9-template-timeout). If records do not appear immediately after enabling export, allow time for the first template packet to be sent.

Important

The documentation default target port is 2055; you must set port=9996 so the export reaches the Netmon collector.

Source: Traffic Flow — RouterOS — MikroTik Documentation. https://help.mikrotik.com/docs/spaces/ROS/pages/21102653/Traffic+Flow

PreviousFortinet FortiSwitch NextHuawei VRP