A RouterOS RFC non-compliance bug silently kills bandwidth utilization graphs in Wanguard — and the one-line workaround.How It Breaks Wanguard Bandwidth Monitoring
🐛 The Bug — ifSpeed Returns 0
Running a 10 Gbps MikroTik router and wondering why Wanguard bandwidth graphs are flat, zeroed-out, or completely wrong? The root cause is a well-known SNMP non-compliance bug in RouterOS.
RFC 2863 says: for interfaces faster than ~4.3 Gbps, ifSpeed must return 4294967295 as a sentinel value, with the true speed in ifHighSpeed (expressed in Mbps).
What RouterOS actually sends over SNMP:
# SNMP walk on a 10G MikroTik interface IF-MIB::ifSpeed.1 = Gauge32: 0 # ← WRONG — should be 4294967295 IF-MIB::ifHighSpeed.1 = Gauge32: 10000 # ← correct (Mbps)
The ifSpeed = 0 is the bug. Any monitoring platform that reads interface speed through standard SNMP OIDs — including Wanguard — will see a zero-speed interface and be unable to compute utilization percentages. This issue is tracked in the MikroTik community forum with no upstream fix as of mid-2026.
📉 Why Wanguard Breaks
Wanguard uses interface speed as the denominator when calculating bandwidth utilization % from NetFlow, IPFIX, or sFlow datagrams. The formula is simple: traffic bytes ÷ interface speed × 100. With a denominator of zero — the calculation is undefined.
❌ Auto-discovered via SNMP
- ifSpeed (SNMP) 0 bps
- Speed IN (Wanguard) 0 Mbps
- Speed OUT (Wanguard) 0 Mbps
- Utilisation graphs Broken
✅ After manual fix
- ifSpeed (SNMP) ignored
- Speed IN (Wanguard) 10 000 Mbps
- Speed OUT (Wanguard) 10 000 Mbps
- Utilisation graphs Correct
Below you can see the Manage Interfaces panel after SNMP auto-discovery — Speed IN picked up 10000 from ifHighSpeed, but Speed OUT pulled from the broken ifSpeed field and came back as 0.
🔍 The Full Setup Context
The flow sensor below is configured to receive NetFlow / IPFIX datagrams from the MikroTik router. SNMP is enabled and set to Auto — which is the source of the problem. Wanguard queries SNMP at sensor start to populate interface speeds automatically.
And here is the live sensor list — notice that ether9, ether10, ether11 carry real traffic (9–10 k pps) yet the graphs are skewed because utilization cannot be properly normalised.
✅ The Workaround — Set Speed Manually
No router changes needed. Override the broken SNMP values directly inside Wanguard's interface configuration. Two minutes, done.
-
Open Wanguard Console → Flow Sensors and click your MikroTik sensor.
-
Click Manage Interfaces in the bottom section of the Flow Sensor Configuration dialog.
-
Select all 10G interfaces (use Select All if needed).
-
Click Set Traffic Direction → Set Stats Engine and set both Speed IN and Speed OUT to
10000(Mbps). -
Click Save. Wanguard will now use the correct reference speed for all calculations.
# What Wanguard will use after the fix: Speed IN = 10000 Mbps # set manually Speed OUT = 10000 Mbps # set manually — overrides broken ifSpeed=0
📋 Summary
| Parameter | SNMP Auto (broken) | After Manual Fix |
|---|---|---|
| ifSpeed source | RouterOS SNMP | Wanguard config |
| Speed OUT | 0 Mbps | 10 000 Mbps |
| Utilisation graphs | Incorrect / broken | Correct |
| NetFlow / IPFIX stats | Skewed | Accurate |
| RFC 2863 compliance | Non-compliant | N/A (bypassed) |
Heads up: if you re-run SNMP discovery or reset interface settings in Wanguard, the broken values will be pulled from RouterOS again and you will need to repeat the manual override.