Layer 2 Security · Topic 3 of 7
Loop Protect and Traffic Storm Control
Stop accidental cable loops with RouterOS loop protect, and limit broadcast, multicast and unknown unicast floods with port flood settings and chip limits.
- 4 min
- Loop protect sends a probe frame and disables the port if it returns.
loop-protect=onis set per Ethernet interface.loop-protect-disable-timesets how long the port stays off.
What it is
Loop protect finds a cable loop and shuts the port, and storm control limits floods of broadcast style traffic.
Both deal with the same danger. In a Layer 2 loop, frames circle forever and multiply until the network stops. Spanning tree prevents this when it is on, but a loop through an unmanaged device, or on a port with spanning tree off, still needs a second line of defence.
Storm control is less drastic. It limits the traffic types that spread everywhere, so a loop or a faulty device cannot fill every link.
How it works
Loop protect watches for its own probe frames, and storm control limits flood traffic.
Loop protect
The port sends a special frame at regular intervals and watches for it to come back.
/interface ethernet set ether5 loop-protect=on loop-protect-send-interval=5s loop-protect-disable-time=5m
/interface ethernet print detailIf the frame returns on a port, a loop exists. The device disables the port, and it turns the port back on after the disable time. The send interval sets how often probes go out.
The loop can pass through other switches, or through a cable between two ports of the same device. Loop protect works without any help from other devices, so it also protects when spanning tree is off.
Enable loop protect on user facing ports, where people may plug a cable into two wall sockets.
Loop protect and spanning tree
The two features overlap, and do different jobs.
| Feature | Detects loops by | Reacts by |
|---|---|---|
| Spanning tree | BPDU exchange between bridges | Blocking a redundant port |
| Loop protect | A probe frame returning to the sender | Disabling the port for a time |
Spanning tree keeps redundancy working, and loop protect is a safety net against mistakes. Use both where the devices support them.
Storm types
A storm is a large volume of traffic that every port must carry.
- Broadcast: sent to all ports, such as ARP and DHCP.
- Multicast with no snooping: flooded like a broadcast.
- Unknown unicast: flooded until the destination is learned.
Flood settings on bridge ports
A bridge port can refuse to send certain flooded traffic.
/interface bridge port set [find interface=ether3] unknown-unicast-flood=no unknown-multicast-flood=no
/interface bridge port set [find interface=ether3] broadcast-flood=noWith unknown-unicast-flood=no, frames for unknown destinations are not sent out of that port. This is safe on a port with a single host that never needs them.
Setting broadcast-flood=no stops broadcasts, and that breaks ARP and DHCP for the host. Use it with care.
Rate limiting storms in the chip
A switch chip can limit the rate of these frame types on a port.
Instead of blocking a type, the chip allows traffic up to a limit and drops the excess. The setting names and units differ between chip families, so check the documentation for the device. Rate limiting in hardware does not load the CPU.
Choose the limit so that normal broadcast traffic passes, and a flood is cut. A very low limit breaks ARP and DHCP, and a very high one does nothing.
Finding the source
When a storm happens, find the port that sends it.
- Look at the port counters and find the port with an unusual packet rate.
- Check for a loop, by looking at which ports show the MAC addresses learned repeatedly.
- Unplug or disable the suspect port.
/interface ethernet print stats
/interface bridge host printA host address that keeps moving between ports in the host table is a strong sign of a loop.
Combined design
For a user facing port, a solid default is spanning tree edge, loop protect on, and limited flooding.
What to remember for the exam
Seven facts cover most questions on this topic.
- Loop protect sends a probe frame and disables the port if it returns.
loop-protect=onis set per Ethernet interface.loop-protect-disable-timesets how long the port stays off.- Loop protect works even when spanning tree is off.
- Storms are broadcast, unsnooped multicast and unknown unicast traffic.
unknown-unicast-flood=noand similar settings limit flooding per bridge port.- Chip rate limits can cap each flood type without using the CPU.
Setting broadcast-flood=no on a port breaks ARP and DHCP for the host behind it.
Common mistakes
These four mistakes appear often.
Relying on spanning tree alone. A loop through an unmanaged device may not be seen.
Disabling broadcast flooding on host ports. The host cannot resolve addresses or get a lease.
Setting a limit that is too low. Normal ARP traffic gets dropped.
Ignoring a moving MAC address. It usually means a loop that nobody has found.
Check yourself
Work through these three questions.
How does loop protect detect a loop?
It sends a probe frame from a port and sees the same frame come back.
What happens to a port when loop protect finds a loop?
The port is disabled, and it comes back after the disable time.
Why is
broadcast-flood=norisky on a host port?It stops broadcasts, which breaks ARP and DHCP for that host.
Topic 3 of 7 in Layer 2 Security
Test yourself on Layer 2 Security
The full MikroTik MTCSWE question bank has 484 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.