MikroTik loop protect and RSTP: stop network loops
Last updated: 11 October 2026
A loop happens when two ports of the same network get joined, often by a customer plugging both ends of a cable into their switch. Broadcasts go round forever, the network slows to a stop, and the router's CPU climbs. RouterOS has two tools against it: spanning tree and loop protect.
Before you change a live router: take a backup (how) and turn on Safe Mode in Winbox, so a mistake that locks you out is undone by itself.
1. RSTP on the bridge
/interface bridge set bridge protocol-mode=rstp
/interface bridge printWith RSTP, switches that also speak spanning tree find loops and block one path. It is MikroTik's recommended method because most managed switches understand it. New RouterOS bridges already use RSTP; older configurations may have protocol-mode=none.
2. Customer ports: edge and BPDU guard
Ports that lead to customers should never have a switch that takes part in your spanning tree. Mark them as edge ports and turn on BPDU guard, which disables the port if spanning-tree packets arrive on it:
/interface bridge port set [find interface=ether5] edge=yes bpdu-guard=yes3. Loop protect
Loop protect sends a small test packet out of a port every few seconds. If the packet comes back in, the port is in a loop and the router disables it for a while. It works even when the devices in the loop know nothing about spanning tree, which is often the case with cheap switches at customers.
/interface ethernet set ether5 loop-protect=on loop-protect-send-interval=5s loop-protect-disable-time=5mThe port is turned off for 5 minutes and then tried again; loop-protect-disable-time=0 keeps it off until you act. It works on Ethernet and VLAN interfaces, including bridged and switched ports. The default value default means off.
4. Find where the loop is
/log print where message~"loop"
/interface ethernet print detail where loop-protect=on
/interface print statsLoop protect writes the port to the log. Without it, look for a port with a huge and fast-growing count of broadcast packets, then unplug ports one by one until the network recovers.
Radio links
Wireless bridges make loops easy when a second path between the same two places exists, such as a backup cable or a second link. Keep RSTP on every bridge they join.
Better: smaller networks
A loop can only hurt the network it is in. Splitting customers into VLANs, or giving each a PPPoE session, keeps one customer's mistake away from everyone else.
Questions and answers
What is loop protect on MikroTik?
A feature that sends test packets out of a port and disables the port if they come back, which means the port is in a loop.
Should I use RSTP or loop protect?
Both. RSTP on bridges, as MikroTik recommends; loop protect on ports towards customers or cheap switches that do not speak spanning tree.
Why does my MikroTik CPU go to 100% when a cable is plugged in?
Very likely a loop: broadcasts circulate and the router processes them. RSTP or loop protect stops it.