MikroTik RouterOS Packet and Connection Marking

Ever since I wrote the book, RouterOS by Example, I get a lot of emails asking me specific questions about this powerful routing system. I try and answer the questions, time allowing, as completely as possible. There is one question that seems to pop up from time to time so I thought it was worth dedicating a blog post to it.

I you are not familiar with the Mangle facility in MikroTik RouterOS, it is a system that allows you to identify traffic and mark it. The identification criteria can be port, protocol, source address or destination address among other things. Once traffic is identified, a mark is associated with the packet and that packet can then be queued, firewalled, nat’ted, etc. to name a few uses.

The question was asked this morning, “Why does everyone suggest marking connections first and then marking packets? Wouldn’t it take less processor power to simply identify and mark the packets with one rule? Good question so let’s explore that.

If you are in a hurry or have a very simple setup, or if for some reason you have connection tracking turned off, then you can simply mark packets without marking connections. Although this is quick and dirty, it requires that the router examine every packet that passes through the router and determine if it meets our matching criteria of our one rule. If you only have a few rules and it works the way you want, then this is probably fine.

For more complicated setups with many rules, this simplistic method will bring a small router to it’s knees by utilizing a huge amount of CPU. In this case, the best strategy is to first identify the traffic and then mark the connections.

Once the connections are identified and marked, simply mark all packets that belong to that connection. This is all about numbers so take a look at an example. My home router currenty shows 118 connections and since I have started writing this post, it has processed more than 13,000 packets. If you were marking packets only, then the router would have had to examine 13,000 packets to determine if there was a match. I you use the two step method, it would examine less than 200 connections for a match and then mark only the assiciated packets. Marking packets in itself is not processor intensive but examining them for a match is. So, in this case, more rules means less resources.

There is a hidden benefit to marking connections first with respect to troubleshooting. When you only mark packets, you don’t get a visual feedback about your effectiveness in rule writing. Yes, the statistics for that rule will increase if you are matching packets, but there is no way to actually see the marks. On the other hand, if you mark connections first, you will see those marks in the connection tracking table. For me, that in itself is worth the little bit of extra effort.

I hope this helps and happy mangling!


Steve Discher

Steve Discher was born in Apple Valley, California and today makes his home in College Station, Texas with his wife and three children. He is a 1987 graduate of Texas A-M University and owns ISP Supplies, a wireless distribution company, and conducts MikroTik training classes. His hobbies include flying his Piper Cub and RV camping with his family.

Recent Posts

  • Finding an IP address with Wireshark using ARP requests

    Can’t remember a device’s IP Address? Address Resolution Protocol (ARP) requests can be used by Wireshark to get the IP address of an unknown host on your network. ARP is a broadcast request that’s meant to help the client machine …

  • Creating Trunk and Access Ports on MikroTik CRS3xx Series Switches

    The switch menu and configuration interface is significantly different on the CRS3xx versus the CRS1xx or CRS2xx series switches and if you are trying to configure VLANs, the process is totally different. Here is a quick HowTo for configuring VLANs …

  • Ubiquiti Unifi Video NVR Upgrade Fails

    Yesterday I got tired of the nagging “Update Available” on my Ubiquiti Video NVR so I went through the upgrade process in the web GUI. It failed with Error 400. I tried several times, several browsers, same error. I then …

See More News