SNMP on MikroTik (RouterOS): Enable It & Key OIDs

By the SNMP Monitoring team · Reviewed July 2026

MikroTik gear is everywhere in WISP and small-to-medium networks, and RouterOS makes SNMP straightforward to enable. The pattern matches every other vendor: interfaces come from the universal IF-MIB, while MikroTik-specific health data — CPU temperature, voltage, fan — lives in the MIKROTIK-MIB under enterprise 1.3.6.1.4.1.14988, in the mtxrHealth area. This guide covers enabling SNMP in RouterOS, reading interfaces, and finding the health metrics, with the usual discipline: we name the MIB and point to MikroTik's documentation rather than inventing leaf OIDs, because not every board exposes every sensor.

Parent: devices. Related: interface sensor, router monitoring.

Enabling SNMP in RouterOS

RouterOS enables SNMP with a couple of commands, either in the terminal or via Winbox. Turn on the service and configure a secured community:

/snmp set enabled=yes contact="netops@example.com" location="Rack 12, DC-East"
/snmp community set [find default=yes] name=S3cr3tR0str1ng addresses=10.0.0.5/32

The secure setup:

1. Enable the service with /snmp set enabled=yes and set contact/location.
2. Rename the default community — never leave it public.
3. Restrict it with addresses= to your manager's IP or subnet.
4. Set it read-only (RouterOS communities are read-only by default unless you enable write).
5. For sensitive deployments, configure an SNMPv3 user instead.

In Winbox the same lives under IP → SNMP. The addresses restriction is RouterOS's built-in source allowlist — combined with a random community it's your baseline; pair it with a firewall rule on UDP 161. More on securing it below.

Interfaces via IF-MIB

MikroTik interfaces are standard IF-MIB, so traffic counters, status, and errors read exactly as on any device — ifName, ifHCInOctets/ifHCOutOctets, ifOperStatus. On a router that's usually the core of what you monitor: per-interface throughput and up/down state, including on VLANs and tunnels which appear as their own interface rows. The high-capacity .31 counters matter on faster links to avoid 32-bit counter wrap. The interface objects are covered on the interface sensor page, with device context on router monitoring.

MikroTik health via MIKROTIK-MIB

MikroTik's vendor health data lives under enterprise 1.3.6.1.4.1.14988, in the MIKROTIK-MIB, primarily the mtxrHealth area:

The important caveat: not all MikroTik boards expose all sensors. A small hAP has no fan and may report no temperature, while a large CCR reports several. So mtxrHealth is hardware-dependent — walk it on your specific device to see what's actually present, rather than assuming a reading exists. Load the MIKROTIK-MIB into your manager so the OIDs resolve to names, and check MikroTik's documentation for the leaves your board supports. Don't fabricate an mtxr OID or assume a sensor your hardware doesn't have.

This board-dependence is worth planning around if you manage a mixed MikroTik fleet, which most WISPs do. A monitoring template that expects a temperature reading will show gaps — or worse, false alarms about "missing" sensors — on the smaller boards that simply don't have them. The robust approach is to build discovery around what each device actually reports: walk mtxrHealth on each board at onboarding, record which sensors exist, and only create health checks for those. That way a hAP lite and a CCR can share the same monitoring system without the smaller device generating noise about hardware it was never built with. It's the same enumerate-then-monitor discipline that keeps any vendor-MIB monitoring honest across heterogeneous hardware — assume nothing, read what's there.

Reading with snmpwalk

Confirm SNMP and identify the device:

snmpwalk -v2c -c S3cr3tR0str1ng 10.0.0.20 system

SNMPv2-MIB::sysDescr.0 = STRING: RouterOS CCR1009 ...
SNMPv2-MIB::sysName.0 = STRING: edge-rtr01

The sysDescr confirms RouterOS and the board model — which tells you which mtxrHealth sensors to expect. Then walk the interface names:

snmpwalk -v2c -c S3cr3tR0str1ng 10.0.0.20 ifName

IF-MIB::ifName.1 = STRING: ether1
IF-MIB::ifName.2 = STRING: ether2
IF-MIB::ifName.3 = STRING: sfp-sfpplus1

With the MIKROTIK-MIB loaded, walk the health subtree by name to see what your board reports — temperature and voltage values will appear only for the sensors that hardware actually has.

Securing it

MikroTik routers often sit at the network edge, so lock SNMP down. The layers:

• Use a random community (or SNMPv3 on RouterOS versions that support it) — never public.
• Restrict with the community's addresses= allowlist to your manager only.
• Add a firewall rule limiting UDP 161 to the management source (firewall setup).
• Keep it read-only — don't enable SNMP write unless you have a specific need.

For anything beyond a trusted management network, prefer SNMPv3's authentication and encryption over a v2c community; the concepts are on SNMPv3 setup. An edge router with an exposed public community is a real risk, so treat it like the security device it effectively is — an unsecured MikroTik at the edge is exactly the kind of device that gets found by internet scanners within minutes and leaks its full configuration profile to anyone who asks.

Frequently asked questions

How do I enable SNMP on MikroTik?

In RouterOS, run /snmp set enabled=yes with contact and location, then configure the community with /snmp community set — rename it from public and restrict it with addresses=<manager-ip>. In Winbox, use IP → SNMP. Keep it read-only, add a firewall rule on UDP 161, and use SNMPv3 for sensitive deployments.

What is MIKROTIK-MIB?

MIKROTIK-MIB is MikroTik's vendor MIB, under enterprise number 1.3.6.1.4.1.14988. It exposes RouterOS-specific data — notably the mtxrHealth area for hardware sensors like CPU temperature, voltage, and fan speed. Interfaces still use the standard IF-MIB; the MIKROTIK-MIB is only for the vendor-specific health and RouterOS metrics.

Can MikroTik report CPU temperature over SNMP?

On boards that have the sensor, yes — CPU temperature is in the mtxrHealth area of the MIKROTIK-MIB. But it's hardware-dependent: smaller boards may have no temperature or fan sensors and won't report them. Walk the health subtree on your specific device to see which readings are actually present rather than assuming a value exists.

What is MikroTik's SNMP enterprise number?

MikroTik's enterprise number is 14988, so its private OIDs live under 1.3.6.1.4.1.14988. The MIKROTIK-MIB — including the mtxrHealth sensors — sits under that branch. Standard data like interfaces uses IF-MIB and the general MIB-II tree, not the MikroTik enterprise number.

Key takeaways

• MikroTik follows standard + vendor: IF-MIB for interfaces, MIKROTIK-MIB for health.
• Enable with /snmp set enabled=yes and a secured /snmp community (rename from public, restrict addresses=).
• Health (CPU temp, voltage, fan) is in mtxrHealth under enterprise 1.3.6.1.4.1.14988.
• Sensors are board-dependent — walk mtxrHealth to see what's present; never assume a leaf.
• Secure it: random community or SNMPv3, source allowlist, and a firewall rule.
• For independent off-box checks, see external monitoring with ostr.io.