Netwatch in MikroTik: Host Monitoring and Script Triggers

Using Netwatch to Monitor Host Availability in MikroTik

Netwatch is a built-in RouterOS tool that continuously monitors whether a host (IP address) is reachable. When a host goes down or comes back up, Netwatch can automatically run scripts — making it perfect for alerting, failover switching, and automated responses.

What Netwatch Does

Netwatch sends ICMP ping packets to a target IP at a set interval. If the host stops responding, Netwatch triggers an "down" script. When it responds again, it triggers an "up" script.

Where to Find It

/tool netwatch

Adding a Netwatch Entry

/tool netwatch add host=8.8.8.8 interval=30s timeout=1s up-script="" down-script="" comment="Monitor Google DNS"

Parameters:

• host — IP address to monitor
• interval — how often to check (e.g., 30s, 1m)
• timeout — how long to wait for a reply before marking as down
• up-script — script to run when host comes back up
• down-script — script to run when host goes down

Viewing Netwatch Status

/tool netwatch print

Example output:

# HOST       STATUS  SINCE
0 8.8.8.8   up      Jun/29/2026 10:00:05
1 192.168.1.1 down  Jun/29/2026 09:45:12

Practical Use Case 1: Failover Trigger

Suppose you have two WAN connections. When the primary WAN gateway goes down, you want to switch to the backup route.

First, set up two default routes:

/ip route add dst-address=0.0.0.0/0 gateway=203.0.113.1 distance=1 comment="Primary WAN"
/ip route add dst-address=0.0.0.0/0 gateway=198.51.100.1 distance=2 comment="Backup WAN"

Then add a Netwatch entry to monitor the primary gateway:

/tool netwatch add host=203.0.113.1 interval=10s timeout=2s   down-script="/ip route set [find comment="Primary WAN"] distance=10"   up-script="/ip route set [find comment="Primary WAN"] distance=1"

When the primary goes down, its route distance increases to 10, making the backup route (distance=2) the active path. When primary recovers, distance goes back to 1.

Practical Use Case 2: Send a Log Entry

/tool netwatch add host=192.168.10.1 interval=60s   down-script="/log warning message="Server 192.168.10.1 is DOWN!""   up-script="/log info message="Server 192.168.10.1 is back UP.""

This writes to the RouterOS log whenever the server changes state.

Practical Use Case 3: Disable an Interface on Failure

/tool netwatch add host=10.0.0.1 interval=20s   down-script="/interface disable ether2"   up-script="/interface enable ether2"

Practical Use Case 4: Trigger an Email Alert

If you have email configured (see the email alerts post), you can send a notification:

/tool netwatch add host=8.8.8.8 interval=30s   down-script="/tool e-mail send to="admin@example.com" subject="WAN DOWN" body="Primary WAN is unreachable!""   up-script="/tool e-mail send to="admin@example.com" subject="WAN UP" body="Primary WAN restored.""

Using Scripts Stored Separately

For complex actions, store the logic in a named script and call it from Netwatch:

/system script add name=wan-failover-down source={
  /ip route set [find comment="Primary WAN"] distance=10
  /log warning message="WAN Failover activated"
}

/tool netwatch add host=203.0.113.1 interval=10s   down-script="/system script run wan-failover-down"

This keeps your Netwatch entries clean and the logic maintainable.

Important Notes

• Netwatch uses ICMP ping — if a firewall blocks ICMP on the target, Netwatch will incorrectly show the host as down
• The timeout must be less than interval
• Scripts run as the system user with full RouterOS permissions — be careful with what you put in them
• On RouterOS v7, Netwatch also supports TCP checking (not just ICMP):

/tool netwatch add host=192.168.1.100 port=80 type=tcp-conn interval=30s   down-script="/log warning message="Web server port 80 down""

Checking Netwatch History

/tool netwatch print detail

This shows extended information including the last check time and status history.

Summary

• Netwatch monitors host reachability with configurable ping intervals
• Triggers up-script and down-script on state changes
• Perfect for failover routing, alerting, and automated responses
• Use TCP checking for service-level monitoring (RouterOS v7)
• Store complex logic in named scripts and call them from Netwatch