The network is dead, every light is flashing

From one second to the next nothing works. No internet, no file server, no WinBox. Look at the switch and every port light is flashing at once in the same rapid rhythm, including ports nobody is using. It usually started after someone moved a cable or added an "extra little switch".

That simultaneous flashing is the giveaway. A busy network blinks irregularly and differently per port. A loop sends the same broadcast around forever, so every port sees exactly the same traffic at exactly the same moment.

What it is not: if one device is slow and the rest works, this is not a loop. If it got worse gradually over weeks, it is not a loop either. A loop arrives in seconds and it is total.

The quick checks, in order

1. Can you still get in? Probably not over the network. Use WinBox by MAC address, or plug a laptop into the offbridge port if you have one. Failing that, a console cable or pulling cables is your only route.
2. How much traffic is there? /interface monitor-traffic interface=bridge. In a loop you see hundreds of thousands of packets per second on a network where nobody is doing anything. That number is the confirmation.
3. Which ports are involved? /interface print stats and look at the packet counters. The ports with the highest numbers are in the loop or next to it.
4. What does the bridge say? /interface bridge host print. The same MAC address appearing on a different port each time you look means the same frame is arriving from two directions, which proves the loop. /log print where topics~"bridge" says the same thing in words.
5. Is spanning tree doing its job? /interface bridge port print. A good answer, where a redundant cable exists, shows one port with the role alternate or status blocking: that one was closed deliberately and that is the point. Everything on forwarding while your cabling has a ring in it means nothing is being blocked.
6. How loaded is the router? /system resource print. In a loop the CPU is pinned, but that is a consequence, not a cause.

The usual causes, most common first

Two cables between the same two devices

Someone wanted redundancy, or thought it would be faster. With RSTP on, the bridge blocks one path and nothing is wrong. With spanning tree off, or with the loop running through equipment that does not speak RSTP, it goes round and round.

An unmanaged switch with a loop in it

The most common form in practice: a cheap switch under a desk where somebody accidentally joined two ports. That switch does not pass RSTP messages on, so your MikroTik cannot see the loop and cannot block it. The storm simply enters your network.

One cable in two wall sockets that land on the same switch

This happens in offices with patch panels, and afterwards it always makes sense and beforehand it never does.

An access point in bridge mode connected both wirelessly and by cable

A repeater or an AP attached to the same network over a cable and over the radio makes a loop through the air.

Spanning tree has been switched off

Sometimes for a reason, for instance because station-pseudobridge cannot cope with it. Then there is no protection left either.

What to do at that moment

1. Pull cables until the flashing stops. Start with the ones that were touched most recently.
2. Once the network is back, plug them in one at a time and see which cable brings it back.
3. Only then fix the cause. A loop you pulled out without understanding it comes back on Monday.

What the configurator does about it

• Spanning tree is in the Bridge & ports section and defaults to RSTP. That is the main protection you get out of the box: a second path between two MikroTiks is blocked instead of looping.
• Draw the cabling on the network board in a way that closes a loop and the check says so: the cable from one device to the other makes a loop in the network, RSTP then blocks one of the paths, it works but it does not add speed. That is the check that catches this before you paste anything.
• The check also reports a cable that connects a device to itself, and a port used by two cables.
• Disable unused ports is a toggle in the same section. A port that is off cannot make a loop.
• DHCP snooping with a list of trusted ports is there too. That is not about loops, but it is about the same kind of accident: somebody plugging their own equipment into the network.
• The offbridge port under Emergency access is worth a lot here. That port takes no part in the bridge and therefore none in the storm: plug a laptop into it and you can still reach your router while a loop is running.

The honest limits

The tool does not set loop-protect or edge ports on the bridge: those settings are not in the schema, so you add them yourself in RouterOS if you want them. More importantly, RSTP only protects what takes part in it. An unmanaged switch, or another brand of device that does not pass the messages on, stays a hole a loop can come through, and you cannot close it from the router's side. The only real answer there is managed equipment, or nobody being allowed to patch their own cables.

Read on: Bridge and ports, Checks about cabling and The network board.