Packets that are processed with hardware offloading enabled bridge will also not be visible (unknown unicast, broadcast and some multicast traffic will be visible to sniffer tool).įile-limit ( integer 10.4294967295 Default: 1000KiB)įile size limit.

(Q: Why didn't I add this to the wiki or forum? A: I have too many passwords already, the Mikrotik people chose not to enable OpenID on the wiki, and google will find the information here too.Note: Unicast traffic between Wireless clients with client-to-client forwarding enabled will not be visible to sniffer tool. Look for tool sniffer set file-name and related options. I've never done it and I have some misgivings about file size, but if you want to run e.g. tool sniffer can dump traffic and save it to a file, which you can FTP elsewhere and look at. Add to Wireshark's filter order to limit the traffic to what you care about. The Wireshark window will immediately fill up and then scroll madly, since Wireshark is showing all the traffic passing through the Mikrotik. You're now ready to start streaming packets from the Mikrotik: tool sniffer set streaming-server=192.0.2.165 streaming-enabled=yes and then tool sniffer start.

Apply filter udp.port = 37008 so that Wireshark will show you only the TZSP packets it receives from the Mikrotik, not random other packets seen by the same interface. Start Wireshark as root and select the interface facing the Mikrotik, which I will pretend has address 192.0.2.165. Second, Wireshark: Mikrotik routers can stream copies of the forwarded packets in real time to Wireshark running on a workstation using a protocol called TZSP, and Wireshark receives the TZSP stream and works with the transmitted packets. It's not something one wants to do on a busy core router, but if the router is lightly loaded, this is a simple and quick way to see what a particular server is up to. This prints various information about active TCP connections, updated every 0.2 seconds. It has solutions for most/all of the problems I like to solve with tcpdump, though.įirst, easiest: tool sniffer start and then tool sniffer connection print interval=0.2. Mikrotik RouterOS doesn't have a tcpdump command.

Mikrotik wireshark capture