MTU · Topic 1 of 3

RouterOS Bridge Overview and MTU

See how a RouterOS bridge handles frame size, why a bridge never fragments, and how bridge MTU relates to the MTU and L2MTU of its member ports.

5 min

In a nutshell

A bridge forwards frames and never fragments packets.
A bridge drops an oversized frame silently and sends no ICMP message.
For bridged traffic, the L2MTU of the ports decides what can pass.

What it is

The RouterOS bridge joins ports into one Layer 2 segment, and frame size limits apply to it like any other interface.

A bridge is a logical interface that holds member ports. Frames move between the ports by MAC address, and the router can also hold an IP address on the bridge itself.

The bridge does not look at IP, so it cannot break a big packet into smaller ones. That one fact explains most MTU trouble on switched networks.

How it works

Each port enforces its own limits, and the bridge only forwards or drops.

Bridge basics

A bridge needs the bridge interface and one port entry for every member.

/interface bridge add name=bridge1
/interface bridge port add bridge=bridge1 interface=ether2
/interface bridge port add bridge=bridge1 interface=ether3
/interface bridge print
/interface bridge port print

Frames received on one port are sent out of the other ports, based on the MAC table. Ports that are offloaded to a switch chip are forwarded in hardware, and the rest go through the CPU.

Where frame size is checked

Three values decide whether a frame can pass.

Value	Applies to	Meaning
`mtu` on the bridge	Traffic to and from the router itself	Largest IP packet the router sends on the bridge
`mtu` on a port	Traffic to and from the router on that port	Largest IP packet the router sends on that port
`l2mtu` on a port	Frames passing through the port	Largest frame the port can receive or send

For traffic that is only forwarded through the bridge, the L2MTU of the ingress and egress ports is what matters. The MTU value of a port does not stop a bridged frame, because the bridge does not read the packet size.

This leads to a common surprise. Two hosts can have a path where the bridge ports have a normal MTU, and yet a frame bigger than the egress L2MTU is still lost.

No fragmentation, no error message

A bridge cannot fragment, and it does not send an ICMP error back to the sender.

When a frame is too large for the egress port, the bridge drops it. The sender gets no reply, so the symptom is often a connection that works for small packets and hangs for large ones.

/ping 192.168.88.20 size=1400 do-not-fragment
/ping 192.168.88.20 size=1500 do-not-fragment

Increase the ping size step by step with the do-not-fragment flag set. The first size that fails shows where the usable limit lies. In RouterOS the size of a ping is the whole IP packet, headers included, so size=1500 tests a 1500 byte MTU. Ping tools on other operating systems usually count only the data and add 28 bytes of IP and ICMP header on top.

Exam tip

Compare the L2MTU of every port on the path with /interface print detail, because one port with a small value breaks the whole path.

Bridge MTU and ports

The bridge interface has its own MTU, shown with /interface bridge print.

If the router has an IP address on the bridge, that address uses the bridge MTU for packets the router itself sends. Setting the bridge MTU higher than a member port can handle only moves the problem to the port. Set matching values on the bridge and on every port that carries that traffic.

/interface bridge set bridge1 mtu=1500
/interface ethernet set ether2 mtu=1500

VLANs add four bytes

A VLAN tag adds four bytes to the Ethernet frame.

A full size untagged frame becomes four bytes bigger once a tag is added. A port must have enough L2MTU for this, or tagged frames at full size are dropped. Bridge VLAN filtering is covered in the VLAN chapter, but the size effect starts here.

What to remember for the exam

Six facts cover most questions on this topic.

A bridge forwards frames and never fragments packets.
A bridge drops an oversized frame silently and sends no ICMP message.
For bridged traffic, the L2MTU of the ports decides what can pass.
The bridge MTU affects traffic to and from the router itself.
A VLAN tag adds four bytes to a frame.
Test a path with /ping using size and do-not-fragment.

Watch out

Do not raise the MTU on only one device. A larger setting at one end does nothing, or causes silent loss, if any hop on the path has a smaller limit.

Common mistakes

These four mistakes appear often.

Expecting a bridge to send ICMP errors. A bridge works at Layer 2, so it only drops oversized frames.

Checking only the MTU. Bridged frames are limited by L2MTU, so read l2mtu on every port.

Forgetting the tag. Tagged traffic is four bytes larger, and a port tuned for untagged frames may drop it.

Changing one port. One member with a smaller limit than the others still breaks the path.

Check yourself

Work through these three questions.

Why does a bridge drop an oversized frame without telling the sender?
A bridge works at Layer 2 and cannot fragment or send ICMP errors, so it drops the frame silently.
Which value limits a frame that is only forwarded through a bridge?
The L2MTU of the ingress and egress ports.
How can you find the largest packet that passes along a path?
Use /ping with size and do-not-fragment, and raise the size until a ping fails.

Topic 1 of 3 in MTU

Test yourself on MTU

The full MikroTik MTCSWE question bank has 484 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.