MIB Viewer

MikroTik

Last updated October 14, 2026

MikroTik (Mikrotīkls SIA) is a Latvian manufacturer of routers, switches and wireless equipment. Its devices run RouterOS, an operating system that includes an SNMP agent. The agent is disabled by default and is configured from the /snmp menu. This article describes how to enable it, how SNMPv3 users are defined, how traps are configured, and which objects are commonly polled.

Supported versions

RouterOS supports SNMP versions 1, 2c and 3 for reading values. Writing is supported for a limited set of objects only. Traps can be sent as version 1, 2 or 3, selected with the trap-version setting; the default is version 1.

Enabling SNMP

The service is enabled and described with the following commands:

/snmp set enabled=yes contact="[email protected]" location="Rack 4, DC1"
/snmp print

The agent answers on the standard SNMP port, UDP 161. If the router firewall filters traffic in the input chain, a rule permitting UDP 161 from the monitoring system is required.

Communities (SNMPv1 and SNMPv2c)

RouterOS ships with a community named public that has no address restriction. Because a community string is sent in clear text, the default community is normally renamed or replaced and limited to the addresses of the monitoring systems:

/snmp community add name=monitor addresses=10.0.0.0/24 read-access=yes write-access=no
/snmp community remove [find name=public]

The main community settings are:

  • name - the community string. For SNMPv3 it is used as the user name.
  • addresses - the addresses allowed to query the agent. The default is 0.0.0.0/0 (any address).
  • read-access - permits read requests. The default is yes.
  • write-access - permits write requests. The default is no.
  • security - one of none, authorized or private. The default is none.

SNMPv3

SNMPv3 users are defined as communities with the security level set to authorized (authentication only) or private (authentication and encryption). The authentication and encryption settings apply only to SNMPv3:

/snmp community add name=snmpuser security=private \
    authentication-protocol=SHA1 authentication-password=AuthPass123 \
    encryption-protocol=AES encryption-password=PrivPass123 \
    addresses=10.0.0.0/24
  • Authentication protocols are MD5 (the default) and SHA1.
  • Encryption protocols are DES (the default) and AES. AES, as specified in RFC 3826, is available from RouterOS 6.16.
  • Each password must be at least 8 characters long.

The engine-id setting in /snmp defines the suffix of the SNMPv3 engine ID. If a management system cannot discover the engine ID automatically, the full value is the prefix 0x80003a8c04 followed by the suffix in hexadecimal. For example, the suffix 1234 gives 80003a8c0431323334.

Traps

Trap behavior is configured in the /snmp menu:

/snmp set trap-target=10.0.0.50 trap-community=monitor trap-version=2 trap-generators=interfaces trap-interfaces=all
  • trap-target - the IPv4 or IPv6 addresses of the systems that receive traps.
  • trap-community - the community, from the community list, used in outgoing traps. The default is public.
  • trap-version - 1, 2 or 3.
  • trap-generators - the events that produce traps, for example interface state changes.
  • trap-interfaces - the interfaces for which traps are sent, or all.
  • src-address - forces a single source address for all SNMP messages. Without it, replies use the address to which the request was sent.

Common OIDs and MIBs

MikroTik enterprise objects are located under enterprises.14988 (1.3.6.1.4.1.14988) and are defined in MIKROTIK-MIB. RouterOS answers queries by OID and does not need MIB files on the device; the files are used by the management system to translate numeric OIDs into names. The following objects are commonly polled:

Standard MIBs are used for the common interface and system data: SNMPv2-MIB for the system group, and IF-MIB for interface names, status and traffic counters. For interfaces faster than 100 Mbit/s the 64-bit counters ifHCInOctets (1.3.6.1.2.1.31.1.1.1.6) and ifHCOutOctets (1.3.6.1.2.1.31.1.1.1.10) are used, because the 32-bit counters wrap too quickly to be sampled reliably.

Writable objects

When a community has write-access=yes, two enterprise objects can change the state of the router:

  • 1.3.6.1.4.1.14988.1.1.7.1.0 - setting any non-zero value reboots the router.
  • 1.3.6.1.4.1.14988.1.1.8.1.1.3.X - setting the object runs the script with index X, counted from 1.

Scripts can also be run with a GET request through the table at 1.3.6.1.4.1.14988.1.1.18, which also requires a write-enabled community (available from RouterOS 6.37). Because of these objects, write access is left disabled on any community used for monitoring only.

Queries from a management host

snmpwalk -v2c -c monitor 192.0.2.1 1.3.6.1.4.1.14988.1.1.3
snmpget -v2c -c monitor 192.0.2.1 1.3.6.1.2.1.1.5.0
snmpwalk -v3 -l authPriv -u snmpuser -a SHA -A AuthPass123 -x AES -X PrivPass123 192.0.2.1 1.3.6.1.2.1.2.2.1.2

The console command print oid, entered at a menu level, lists the OIDs that correspond to the properties at that level.

Common problems

  • No response from the agent. The service is disabled until /snmp set enabled=yes is entered. A community with a restricted addresses value ignores requests from other hosts, and a firewall rule in the input chain can block UDP 161.
  • Replies from an unexpected address. Without src-address, a router with several addresses answers from the address that received the request. Management systems that match replies by source address may require src-address to be set.
  • SNMPv3 authentication fails. The protocols and passwords on the management system must match the community exactly, including the default MD5 and DES values when none were specified. If the engine ID is not discovered, the value described above is entered manually.
  • Interface counters appear to reset. Polling the 32-bit counters of a fast interface produces wrapped values; the 64-bit counters in IF-MIB avoid this.

RouterOS documentation recommends SNMPv3 with authentication and encryption for production use, since the community string of versions 1 and 2c is transmitted in clear text.