Neighbour discovery (MNDP/CDP/LLDP) active on the WAN side

What the audit found

Neighbour discovery on your router is enabled on an interface list that includes the WAN port. RouterOS speaks three discovery protocols — MikroTik's own MNDP, Cisco's CDP and the standard LLDP — and on every interface where discovery is active it periodically broadcasts a packet describing itself: device identity, model, RouterOS version, software ID, MAC and IP addresses, and uptime.

The audit reports this as low on devices with a WAN interface. On a switch or access point that sits entirely inside a trusted network it is not a concern.

Why it matters

Discovery is what makes the Winbox neighbour list work: you plug a laptop into a MikroTik network and the routers appear by name, ready to connect. That convenience is exactly what you do not want to offer on the internet-facing port.

Anyone in the same layer-2 segment as your WAN interface receives the announcements. On a typical ISP connection that means other customers on the same access node, the provider's aggregation equipment, and on shared media anyone who can listen. What they learn is precise: not just "there is a MikroTik here" but which model and which RouterOS version. An attacker who sees 6.42.6 in a discovery packet knows without scanning that the Winbox bug from 2018 (CVE-2018-14847) applies, and where to send the exploit.

The information also feeds targeting the other way round: a router that announces a company name in its identity ("acme-office-gw") ties a public network location to an organisation.

None of this gives anyone access by itself, which is why the severity is low. Discovery is a disclosure, not a hole. But it is a free gift to whoever is looking, it serves no purpose on the WAN side, and it takes one setting to stop.

What it looks like in Winbox

Open IP → Neighbors and click Discovery Settings. The Interface List field shows where discovery is active. If it reads all, static or a list that contains your WAN port, this is the finding. The Neighbors tab itself is informative too: any device listed with your WAN interface in the Interface column is something that sees your announcements as well.

How to fix it

The fix is to change the Interface List in IP → Neighbors → Discovery Settings from all to your LAN interface list. After that, the router announces itself and listens for neighbours only on interfaces that belong to that list, and the provider segment hears nothing.

The setting refers to an interface list, conventionally named LAN. Confirm under Interfaces → Interface List that it exists and contains your bridge or internal ports; a router built from the default configuration already has it. If the list is missing, create and populate it first, otherwise discovery silently stops everywhere. If you run several MikroTik devices in a chain — a router behind a router, say — make sure the inter-router link is a member of the LAN list on both sides if you rely on the neighbour list to reach them.

If you do not use the neighbour list at all, choosing none switches discovery off entirely. Most administrators keep it on the LAN, where it is genuinely useful for finding devices and for the Winbox neighbour view.

The change has no effect on routing, management or existing sessions, so Safe Mode is not needed. Afterwards, within a minute, any upstream device that previously appeared in IP → Neighbors on the WAN interface should drop off the list, since the router has also stopped listening there, while a second MikroTik on the LAN should still see this router in its own neighbour list. Then re-run the audit; the finding disappears.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

My ISP asked me to leave LLDP on so they can see my device. Should I?

That is a reasonable request on a managed connection, and the risk is small. If you agree, you can create a dedicated interface list containing just the WAN port and enable discovery for it, but be aware that the same announcement reaches everyone on that segment, not just the ISP. Ask whether they actually rely on it before leaving it on.

Is this the same as the MAC server setting?

They are related but separate. Discovery tells neighbours that the router exists and what it is. The MAC server lets them log in by MAC address. Both should be restricted to the LAN; the MAC server has its own finding and its own setting under Tools → MAC Server.

The router identity contains my company name. Should I change it?

It does no harm on the LAN, and once discovery is off on the WAN side nobody outside sees it. If the identity also appears elsewhere — in SNMP, in the web interface banner, in reverse DNS — a neutral name is a small improvement, but it is not essential.