02.06.2026 · 3 minutes read

A RouterOS RFC non-compliance bug silently kills bandwidth utilization graphs in Wanguard — and the one-line workaround.How It Breaks Wanguard Bandwidth Monitoring

📅 June 2026🏷️ RouterOS · Wanguard · SNMP · NetFlow · IPFIX⏱️ 3 min read

🐛 The Bug — ifSpeed Returns 0

Running a 10 Gbps MikroTik router and wondering why Wanguard bandwidth graphs are flat, zeroed-out, or completely wrong? The root cause is a well-known SNMP non-compliance bug in RouterOS.

RFC 2863 says: for interfaces faster than ~4.3 Gbps, ifSpeed must return 4294967295 as a sentinel value, with the true speed in ifHighSpeed (expressed in Mbps).

What RouterOS actually sends over SNMP:

# SNMP walk on a 10G MikroTik interface
IF-MIB::ifSpeed.1      = Gauge32: 0          # ← WRONG — should be 4294967295
IF-MIB::ifHighSpeed.1  = Gauge32: 10000      # ← correct (Mbps)

The ifSpeed = 0 is the bug. Any monitoring platform that reads interface speed through standard SNMP OIDs — including Wanguard — will see a zero-speed interface and be unable to compute utilization percentages. This issue is tracked in the MikroTik community forum with no upstream fix as of mid-2026.

📉 Why Wanguard Breaks

Wanguard uses interface speed as the denominator when calculating bandwidth utilization % from NetFlow, IPFIX, or sFlow datagrams. The formula is simple: traffic bytes ÷ interface speed × 100. With a denominator of zero — the calculation is undefined.

❌ Auto-discovered via SNMP

  • ifSpeed (SNMP) 0 bps
  • Speed IN (Wanguard) 0 Mbps
  • Speed OUT (Wanguard) 0 Mbps
  • Utilisation graphs Broken

✅ After manual fix

  • ifSpeed (SNMP) ignored
  • Speed IN (Wanguard) 10 000 Mbps
  • Speed OUT (Wanguard) 10 000 Mbps
  • Utilisation graphs Correct

Below you can see the Manage Interfaces panel after SNMP auto-discovery — Speed IN picked up 10000 from ifHighSpeed, but Speed OUT pulled from the broken ifSpeed field and came back as 0.



🔍 The Full Setup Context

The flow sensor below is configured to receive NetFlow / IPFIX datagrams from the MikroTik router. SNMP is enabled and set to Auto — which is the source of the problem. Wanguard queries SNMP at sensor start to populate interface speeds automatically.

Flow Sensor Configuration: Mikrotik Flows, NetFlow/IPFIX, SNMP Enabled

And here is the live sensor list — notice that ether9, ether10, ether11 carry real traffic (9–10 k pps) yet the graphs are skewed because utilization cannot be properly normalised.

The Workaround — Set Speed Manually



No router changes needed. Override the broken SNMP values directly inside Wanguard's interface configuration. Two minutes, done.

  1. Open Wanguard Console → Flow Sensors and click your MikroTik sensor.

  2. Click Manage Interfaces in the bottom section of the Flow Sensor Configuration dialog.

  3. Select all 10G interfaces (use Select All if needed).

  4. Click Set Traffic Direction → Set Stats Engine and set both Speed IN and Speed OUT to 10000 (Mbps).

  5. Click Save. Wanguard will now use the correct reference speed for all calculations.

# What Wanguard will use after the fix:
Speed IN  = 10000 Mbps   # set manually
Speed OUT = 10000 Mbps   # set manually — overrides broken ifSpeed=0

📋 Summary

Parameter SNMP Auto (broken) After Manual Fix
ifSpeed source RouterOS SNMP Wanguard config
Speed OUT 0 Mbps 10 000 Mbps
Utilisation graphs Incorrect / broken Correct
NetFlow / IPFIX stats Skewed Accurate
RFC 2863 compliance Non-compliant N/A (bypassed)
⚠️

Heads up: if you re-run SNMP discovery or reset interface settings in Wanguard, the broken values will be pulled from RouterOS again and you will need to repeat the manual override.

🔧 MikroTik📡 RouterOS🔎 SNMP📊 Wanguard🌊 NetFlow📦 IPFIX🚀 10 Gbps🛡️ RFC 2863

Tested with RouterOS 7.x · Wanguard 8.x