routeros-sniffer

Name: routeros-sniffer
Author: tikoci

36stars8forks

How to install routeros-sniffer?

tikoci/routeros-skills/routeros-sniffer

$npx -y skills add tikoci/routeros-skills --skill routeros-sniffer

Installs into the current project.

Summary

RouterOS packet capture and TZSP streaming for protocol debugging. Use when: capturing packets on RouterOS, setting up /tool/sniffer, streaming live traffic via TZSP, using firewall mangle action=sniff-tzsp, debugging network protocols on MikroTik, receiving TZSP with Wireshark o

Files · 1

View on GitHub

SKILL.md

1	# RouterOS Packet Capture & TZSP Streaming
2
3	RouterOS has a built-in packet sniffer (`/tool/sniffer`) and firewall mangle actions that can mirror traffic — either saving to a file on the router or streaming live to a remote host via TZSP (TaZmen Sniffer Protocol). This is the primary way to capture packets on RouterOS since standard tools like `tcpdump` do not exist (see `routeros-fundamentals` skill).
4
5	## Why This Matters for Agents
6
7	When debugging any network protocol issue on RouterOS, agents should know they can:
8
9	1. Stream live packets from the router to the host machine via TZSP — no hardware needed if using a CHR VM
10	2. Save pcap/pcapng files on the router's flash and download them for analysis
11	3. Use firewall mangle rules for surgical, per-flow packet mirroring without touching the sniffer config
12
13	Combined with a QEMU CHR instance (see `routeros-qemu-chr` skill), this gives agents a complete packet-level debugging workflow with zero physical hardware.
14
15	## Method 1: /tool/sniffer (Full Capture Tool)
16
17	The built-in sniffer captures packets on specified interfaces with extensive filtering. It supports three independent output modes that can be combined:
18
19	\| Output \| Setting \| Notes \|
20	\|--------\|---------\|-------\|
21	\| Memory buffer \| (always on) \| Viewable via `quick`, `packet`, `protocol`, `host`, `connection` submenus. Packets available for 10 minutes \|
22	\| File on flash \| `file-name=capture.pcap` \| PCAPNG format since RouterOS 7.20 \|
23	\| TZSP stream \| `streaming-enabled=yes` \| UDP to `streaming-server` on `streaming-port` (default 37008) \|
24
25	### Live TZSP Streaming
26
27	```routeros
28	# Configure sniffer to stream via TZSP to a remote host
29	/tool/sniffer
30	set streaming-enabled=yes streaming-server=<RECEIVER-IP>:37008
31
32	# Optional: filter to a specific interface or protocol
33	set filter-interface=ether1
34	set filter-ip-protocol=icmp
35
36	# Start capture (runs until stopped or router reboots)
37	/tool/sniffer/start
38
39	# Stop when done
40	/tool/sniffer/stop
41	```
42
43	The receiver host runs Wireshark, tshark, or another TZSP-capable tool (see [TZSP receivers reference](./references/tzsp-receivers.md)).
44
45	### File-Based Capture
46
47	```routeros
48	# Capture to file on router flash
49	/tool/sniffer
50	set file-name=capture.pcap filter-interface=ether1
51
52	/tool/sniffer/start
53	# ... let it capture ...
54	/tool/sniffer/stop
55
56	# Or save the memory buffer to a file manually
57	/tool/sniffer/save file-name=/flash/debug.pcap
58
59	# Download via SCP or fetch
60	# From the host:
61	# scp admin@<ROUTER-IP>:/flash/debug.pcap .
62	```
63
64	File + streaming can run simultaneously:
65
66	```routeros
67	/tool/sniffer
68	set file-name=capture.pcap streaming-enabled=yes streaming-server=<RECEIVER-IP>:37008
69	/tool/sniffer/start
70	```
71
72	### Quick Mode (Interactive CLI)
73
74	For quick one-off inspection directly on the router console:
75
76	```routeros
77	# Quick-capture ICMP traffic on ether1
78	/tool/sniffer/quick ip-protocol=icmp interface=ether1
79	```
80
81	This shows a live scrolling table on the console with source/dest MAC, IP, protocol, and size.
82
83	### Sniffer Filter Properties
84
85	Key filter options for `/tool/sniffer/set`:
86
87	\| Property \| Description \|
88	\|----------\|-------------\|
89	\| `filter-interface` \| Interface name or `all` (default: `all`) \|
90	\| `filter-ip-address` \| Up to 16 IP/mask entries \|
91	\| `filter-dst-ip-address` \| Up to 16 destination IP/mask entries \|
92	\| `filter-src-ip-address` \| Up to 16 source IP/mask entries \|
93	\| `filter-port` \| Up to 16 ports (supports `!` negation) \|
94	\| `filter-ip-protocol` \| Up to 16 protocols (tcp, udp, icmp, etc.) \|
95	\| `filter-mac-protocol` \| Up to 16 MAC protocols (ip, arp, ipv6, vlan, etc.) \|
96	\| `filter-direction` \| `any`, `rx`, or `tx` \|
97	\| `filter-stream` \| `yes`/`no` — filter out sniffer's own TZSP packets (default: yes) \|
98	\| `filter-vlan` \| Up to 16 VLAN IDs \|
99	\| `memory-limit` \| Memory buffer size (default: 100 KiB) \|
100	\| `file-limit` \| Max file size (default: 1000 KiB) \|
101	\| `only-headers` \| Save only packet headers, not full payload \|
102
103	Important: `filter-stream=yes` (default) excludes the sniffer's own TZSP stream packets from the capture — leave this on to avoid feedback loops.
104
105	## Method 2: Firewall Mangle (Targeted Mirroring)
106
107	Firewall mangle rules offer granular per-flow mirroring using the full firewall matcher. Two sniff-related actions exist:
108
109	### action=sniff-tzsp (Stream to Remote TZSP Receiver)
110
111	Mirrors matching packets as TZSP to a remote host. Uses the firewall's full matching engine (src/dst address, protocol, port, connection state, interface, etc.):
112
113	```routeros
114	# Mirror all forwarded ICMP to a TZSP receiv

People who liked this also viewed

6 picks

Type

routeros-sniffer

36stars8forks

View on GitHub

How to install routeros-sniffer?

tikoci/routeros-skills/routeros-sniffer

$npx -y skills add tikoci/routeros-skills --skill routeros-sniffer

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# RouterOS Packet Capture & TZSP Streaming
2
3	RouterOS has a built-in packet sniffer (`/tool/sniffer`) and firewall mangle actions that can mirror traffic — either saving to a file on the router or streaming live to a remote host via TZSP (TaZmen Sniffer Protocol). This is the primary way to capture packets on RouterOS since standard tools like `tcpdump` do not exist (see `routeros-fundamentals` skill).
4
5	## Why This Matters for Agents
6
7	When debugging any network protocol issue on RouterOS, agents should know they can:
8
9	1. Stream live packets from the router to the host machine via TZSP — no hardware needed if using a CHR VM
10	2. Save pcap/pcapng files on the router's flash and download them for analysis
11	3. Use firewall mangle rules for surgical, per-flow packet mirroring without touching the sniffer config
12
13	Combined with a QEMU CHR instance (see `routeros-qemu-chr` skill), this gives agents a complete packet-level debugging workflow with zero physical hardware.
14
15	## Method 1: /tool/sniffer (Full Capture Tool)
16
17	The built-in sniffer captures packets on specified interfaces with extensive filtering. It supports three independent output modes that can be combined:
18
19	\| Output \| Setting \| Notes \|
20	\|--------\|---------\|-------\|
21	\| Memory buffer \| (always on) \| Viewable via `quick`, `packet`, `protocol`, `host`, `connection` submenus. Packets available for 10 minutes \|
22	\| File on flash \| `file-name=capture.pcap` \| PCAPNG format since RouterOS 7.20 \|
23	\| TZSP stream \| `streaming-enabled=yes` \| UDP to `streaming-server` on `streaming-port` (default 37008) \|
24
25	### Live TZSP Streaming
26
27	```routeros
28	# Configure sniffer to stream via TZSP to a remote host
29	/tool/sniffer
30	set streaming-enabled=yes streaming-server=<RECEIVER-IP>:37008
31
32	# Optional: filter to a specific interface or protocol
33	set filter-interface=ether1
34	set filter-ip-protocol=icmp
35
36	# Start capture (runs until stopped or router reboots)
37	/tool/sniffer/start
38
39	# Stop when done
40	/tool/sniffer/stop
41	```
42
43	The receiver host runs Wireshark, tshark, or another TZSP-capable tool (see [TZSP receivers reference](./references/tzsp-receivers.md)).
44
45	### File-Based Capture
46
47	```routeros
48	# Capture to file on router flash
49	/tool/sniffer
50	set file-name=capture.pcap filter-interface=ether1
51
52	/tool/sniffer/start
53	# ... let it capture ...
54	/tool/sniffer/stop
55
56	# Or save the memory buffer to a file manually
57	/tool/sniffer/save file-name=/flash/debug.pcap
58
59	# Download via SCP or fetch
60	# From the host:
61	# scp admin@<ROUTER-IP>:/flash/debug.pcap .
62	```
63
64	File + streaming can run simultaneously:
65
66	```routeros
67	/tool/sniffer
68	set file-name=capture.pcap streaming-enabled=yes streaming-server=<RECEIVER-IP>:37008
69	/tool/sniffer/start
70	```
71
72	### Quick Mode (Interactive CLI)
73
74	For quick one-off inspection directly on the router console:
75
76	```routeros
77	# Quick-capture ICMP traffic on ether1
78	/tool/sniffer/quick ip-protocol=icmp interface=ether1
79	```
80
81	This shows a live scrolling table on the console with source/dest MAC, IP, protocol, and size.
82
83	### Sniffer Filter Properties
84
85	Key filter options for `/tool/sniffer/set`:
86
87	\| Property \| Description \|
88	\|----------\|-------------\|
89	\| `filter-interface` \| Interface name or `all` (default: `all`) \|
90	\| `filter-ip-address` \| Up to 16 IP/mask entries \|
91	\| `filter-dst-ip-address` \| Up to 16 destination IP/mask entries \|
92	\| `filter-src-ip-address` \| Up to 16 source IP/mask entries \|
93	\| `filter-port` \| Up to 16 ports (supports `!` negation) \|
94	\| `filter-ip-protocol` \| Up to 16 protocols (tcp, udp, icmp, etc.) \|
95	\| `filter-mac-protocol` \| Up to 16 MAC protocols (ip, arp, ipv6, vlan, etc.) \|
96	\| `filter-direction` \| `any`, `rx`, or `tx` \|
97	\| `filter-stream` \| `yes`/`no` — filter out sniffer's own TZSP packets (default: yes) \|
98	\| `filter-vlan` \| Up to 16 VLAN IDs \|
99	\| `memory-limit` \| Memory buffer size (default: 100 KiB) \|
100	\| `file-limit` \| Max file size (default: 1000 KiB) \|
101	\| `only-headers` \| Save only packet headers, not full payload \|
102
103	Important: `filter-stream=yes` (default) excludes the sniffer's own TZSP stream packets from the capture — leave this on to avoid feedback loops.
104
105	## Method 2: Firewall Mangle (Targeted Mirroring)
106
107	Firewall mangle rules offer granular per-flow mirroring using the full firewall matcher. Two sniff-related actions exist:
108
109	### action=sniff-tzsp (Stream to Remote TZSP Receiver)
110
111	Mirrors matching packets as TZSP to a remote host. Uses the firewall's full matching engine (src/dst address, protocol, port, connection state, interface, etc.):
112
113	```routeros
114	# Mirror all forwarded ICMP to a TZSP receiv

People who liked this also viewed

6 picks

Type