RouterOS Proprietary Protocols and File Formats

An index of MikroTik-specific wire protocols and files. Each row gives a fingerprint, where to read, and what the linked material covers. The linked docs and code hold the details; read them before implementing anything.

Coverage describes what this index links, not all public knowledge: docs (vendor behavior/config docs), spec (vendor wire spec), code (tikoci implementation), research (version-scoped m2ir findings), leads (sources to investigate; not assessed here), gap (wire/format details not curated here).

WinBox first

WinBox talks to RouterOS's internal M2 (nv::message) / nova IPC system. That makes WinBox the main entry point for understanding how the router represents configuration. Start with m2ir's agent reading map. It routes capture decoding, patched WinBox clients, and native configuration backends to canonical YAML. For other formats, use the format and research index.

Protocols

Ports and EtherTypes are defaults and clues, not proof of protocol. They come from MikroTik's Services page, the bridge filter MAC-protocol list, and the linked protocol pages.

Protocol	On the wire	Read	Coverage
WinBox / M2 / nova IPC	TCP 8291 (also the mobile app and The Dude)	m2ir map, WinBox guide	research: framing, auth, crypto, selected handlers
MAC-WinBox	UDP 20561 (MAC server)	m2ir source inventory	docs, leads
MAC-Telnet / MAC-Ping	UDP 20561	routeros-mac-telnet	code (centrs); MAC-Ping payload only sketched
RoMON	EtherType 0x88bf, dst 01:80:c2:00:88:bf	RoMON	docs; centrs support not started
MNDP	UDP 5678	routeros-mndp, centrs codec	code; some values unknown (m2ir#3)
API / API-SSL	TCP 8728 / 8729	API, routeros-tikoci-centrs	spec, code (centrs)
Bandwidth test	TCP 2000; UDP allocated from 2000 upward	Bandwidth test, centrs btest	code: client and server, tested against CHR
EoIP / EoIPv6	EoIP: GRE, IP protocol 47	EoIP	docs; no wire reference
IP packing	EtherType 0x9000 simple / 0x9001 compressed; MNDP TLV 14 advertises unpacking	IP packing, m2ir#3	docs; frame and compression formats are a gap
WebFig /jsproxy	HTTP(S) to /jsproxy, Content-Type: msg	routeros-webfig (validation notes)	observed only; gap
CAPsMAN	WiFi: TCP and UDP 5246; legacy: UDP 5246 control, 5247 data; or Layer 2	WiFi CAPsMAN	docs
CMR	TCP 54321	routeros-cmr	docs, lab-tested operation; no wire reference
MLAG ICCP	EtherType 0x88b5, dst 01:80:c2:00:00:0e	MLAG	docs
Loop Protect	EtherType 0x9003	Loop Protect	docs
Nv2 / NStreme	Wireless MAC layer (legacy wireless package)	Nv2	docs
MikroTik cloud	cloud2.mikrotik.com UDP 15252 (DDNS), TCP 15252 (backup)	Cloud server communication	docs; payloads are a gap
The Dude client/server	Via the WinBox service	Dude (discontinued)	gap; dude.db files are under Files
Netinstall / Etherboot	BOOTP/DHCP ports, TFTP	routeros-netinstall	workflow docs; no wire reference

For what centrs implements today, check its capability matrix.

Files

Routes and boundaries are maintained in the m2ir format and research index.

Artifact	Start	Coverage
WinBox .cdb saved connections	centrs reader	code; m2ir profile is a placeholder
WinBox .wbx saved sessions	m2ir source inventory	leads
The Dude dude.db object blobs	m2ir Dude profile → donny, TheDudeToHuman	research: initial schema
.x3 metadata, /rw/store/cfg.*	m2ir CHR extraction; SYS_OWNER	research, version-scoped
NPK, binary .backup, user database, supout.rif	m2ir source inventory	leads

Standard building blocks and related formats

• Back To Home: the VPN data plane is WireGuard and works with standard clients. MikroTik adds provisioning, DNS naming, and an optional relay.
• REST is HTTP(S) and JSON over RouterOS menu paths; see routeros-fundamentals.
• .rsc exports are RouterOS script text, not binary backups; see routeros-scripting.
• TZSP sniffer streaming is TamoSoft's format; see routeros-sniffer.

Evidence

A shared EC-SRP5 login (WinBox, MAC-Telnet, btest) proves that login, not a shared session format or native WinBox config access. m2ir findings are version-scoped: read each entry's confidence, evidence, and version range, and record the RouterOS/client versions you used. When only docs or leads exist, say so instead of inventing a grammar. Report observations and negative results through m2ir's discovery guidance.