Tools · Topic 2 of 2

Other Layer 2 Diagnostic Tools

Use the RouterOS packet sniffer, torch, bridge host table and Ethernet monitor to troubleshoot Layer 2 problems when port mirroring is not available.

  • 4 min
In a nutshell
  • /interface ethernet monitor shows link state, rate and duplex.
  • print stats shows counters, including errors.
  • /interface bridge host print shows where each MAC address was learned.

What it is

RouterOS includes several built in tools that help you find Layer 2 faults without extra hardware.

Port mirroring needs a free port and an analyser. These tools run on the router itself, so you can start them from the console at once. Each tool answers a different question, from link state to frame content.

Link problemcable or speedcheck withEthernet monitorstate and ratethenHost tablewho is wherethenSnifferframe contents

The skill is choosing the right tool for the question, and knowing what it cannot see.

How it works

Start with the simplest tool, and move to the detailed ones only if needed.

Ethernet monitor

The monitor shows the state of a physical port.

/interface ethernet monitor ether1
/interface ethernet print stats

It reports whether the link is up, the negotiated rate and duplex, and what the link partner advertises. The stats view shows counters, including errors and dropped frames. A rising error count suggests a cable or duplex problem.

The bridge host table

The host table shows which MAC address was learned on which port.

/interface bridge host print
/interface bridge host print where mac-address=00:11:22:33:44:55

Use it to answer where a device is. If a MAC address appears on a different port from the one you expect, the device moved, or something is wrong. If the same address keeps changing ports, suspect a loop.

Bridge and port status

Check the state of the bridge and its ports.

/interface bridge monitor bridge1
/interface bridge port print

This shows the spanning tree root and the role and state of each port. It also shows hardware offload flags, which tell you whether the CPU or the chip switches the traffic.

Torch

Torch shows live traffic on an interface, grouped by flow.

/tool torch interface=ether1

You see addresses, protocols and rates as they change. Torch counts the traffic that the CPU handles, so it works well on routed and bridged software traffic. It shows rates, not frame contents.

Packet sniffer

The sniffer captures frames and can send them to an analyser.

/tool sniffer set filter-interface=ether1 streaming-enabled=yes streaming-server=192.168.88.100
/tool sniffer start
/tool sniffer stop

With streaming on, the router sends the captured packets to the address you set, where an analyser can read them. Use filters on the interface or on addresses to keep the volume down. The sniffer sees what the CPU handles, so frames switched in hardware are missed.

Watch out

A capture on a busy interface can load the CPU. Use narrow filters, and stop the capture when you have what you need.

Cable testing

Some Ethernet ports can test the cable.

/interface ethernet cable-test ether1

The test reports the state of each pair, and can estimate where a fault lies. Support depends on the model. The port may drop its link during the test.

Choosing the tool

QuestionTool
Is the link up, and at what rate?Ethernet monitor
Are there errors on the port?print stats
Where is this MAC address?Bridge host table
Which flows use this link now?Torch
What do the frames contain?Sniffer or port mirroring
Is the cable damaged?Cable test

Using the tools together

Work from simple to detailed.

  1. Check link state and counters.
  2. Check the host table and the bridge.
  3. Use torch to find heavy flows.
  4. Capture or mirror only when you need frame detail.
Exam tip

If the sniffer shows nothing for traffic that you know is flowing, check the offload flag. The frames may never reach the CPU.

What to remember for the exam

Seven facts cover most questions on this topic.

  • /interface ethernet monitor shows link state, rate and duplex.
  • print stats shows counters, including errors.
  • /interface bridge host print shows where each MAC address was learned.
  • A MAC address that keeps changing ports points to a loop.
  • Torch shows live flows and rates for the traffic that the CPU handles.
  • The sniffer can stream captures to an analyser.
  • Software tools miss frames that the switch chip forwards in hardware.

Common mistakes

These four mistakes appear often.

Using the sniffer on hardware switched traffic. The CPU never sees those frames.

Capturing without filters. The router becomes slow, and the capture is too large to read.

Ignoring error counters. A rising count is the early sign of a bad cable or duplex mismatch.

Skipping the simple checks. Many faults are visible in the monitor or host table.

Check yourself

Work through these three questions.

  • Which tool tells you on which port a MAC address was learned?

    /interface bridge host print.

  • Why might the sniffer miss traffic on a CRS port?

    Frames switched in hardware never reach the CPU, and the sniffer captures only what the CPU handles.

  • What does a rising error counter in print stats suggest?

    A cable or duplex problem on that port.

Topic 2 of 2 in Tools

Test yourself on Tools

The full MikroTik MTCSWE question bank has 484 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.