RouterOS Packet Capture & TZSP Streaming

RouterOS has a built-in packet sniffer (

/tool/sniffer

tcpdump

routeros-fundamentals

Why This Matters for Agents

When debugging any network protocol issue on RouterOS, agents should know they can:

1. Stream live packets from the router to the host machine via TZSP — no hardware needed if using a CHR VM
2. Save pcap/pcapng files on the router's flash and download them for analysis
3. Use firewall mangle rules for surgical, per-flow packet mirroring without touching the sniffer config

Combined with a QEMU CHR instance (see

routeros-qemu-chr

Method 1: /tool/sniffer (Full Capture Tool)

The built-in sniffer captures packets on specified interfaces with extensive filtering. It supports three independent output modes that can be combined:

quick

packet

protocol

host

connection

file-name=capture.pcap

streaming-enabled=yes

streaming-server

streaming-port

Live TZSP Streaming

# Configure sniffer to stream via TZSP to a remote host
/tool/sniffer
set streaming-enabled=yes streaming-server=<RECEIVER-IP>:37008

# Optional: filter to a specific interface or protocol
set filter-interface=ether1
set filter-ip-protocol=icmp

# Start capture (runs until stopped or router reboots)
/tool/sniffer/start

# Stop when done
/tool/sniffer/stop

The receiver host runs Wireshark, tshark, or another TZSP-capable tool (see TZSP receivers reference).

File-Based Capture

# Capture to file on router flash
/tool/sniffer
set file-name=capture.pcap filter-interface=ether1

/tool/sniffer/start
# ... let it capture ...
/tool/sniffer/stop

# Or save the memory buffer to a file manually
/tool/sniffer/save file-name=/flash/debug.pcap

# Download via SCP or fetch
# From the host:
# scp admin@<ROUTER-IP>:/flash/debug.pcap .

File + streaming can run simultaneously:

/tool/sniffer
set file-name=capture.pcap streaming-enabled=yes streaming-server=<RECEIVER-IP>:37008
/tool/sniffer/start

Quick Mode (Interactive CLI)

For quick one-off inspection directly on the router console:

# Quick-capture ICMP traffic on ether1
/tool/sniffer/quick ip-protocol=icmp interface=ether1

This shows a live scrolling table on the console with source/dest MAC, IP, protocol, and size.

Sniffer Filter Properties

Key filter options for

/tool/sniffer/set

filter-interface

all

all

filter-ip-address

filter-dst-ip-address

filter-src-ip-address

filter-port

!

filter-ip-protocol

filter-mac-protocol

filter-direction

any

rx

tx

filter-stream

yes

no

filter-vlan

memory-limit

file-limit

only-headers

Important:

filter-stream=yes

Method 2: Firewall Mangle (Targeted Mirroring)

Firewall mangle rules offer granular per-flow mirroring using the full firewall matcher. Two sniff-related actions exist:

action=sniff-tzsp (Stream to Remote TZSP Receiver)

Mirrors matching packets as TZSP to a remote host. Uses the firewall's full matching engine (src/dst address, protocol, port, connection state, interface, etc.):

# Mirror all forwarded ICMP to a TZSP receiver
/ip/firewall/mangle
add action=sniff-tzsp chain=forward protocol=icmp \
    sniff-target=<RECEIVER-IP> sniff-target-port=37008 \
    comment="TZSP mirror ICMP to Wireshark"

# Mirror traffic from a specific host
/ip/firewall/mangle
add action=sniff-tzsp chain=forward src-address=192.168.88.100 \
    sniff-target=<RECEIVER-IP> sniff-target-port=37008

# Mirror DNS queries
/ip/firewall/mangle
add action=sniff-tzsp chain=forward protocol=udp dst-port=53 \
    sniff-target=<RECEIVER-IP> sniff-target-port=37008

Properties for

sniff-tzsp

• sniff-target

  (IP) — destination IP for the TZSP UDP packets

• sniff-target-port

  (port, default 37008) — destination UDP port

• sniff-id

  — optional identifier tag

Key behavior:

sniff-tzsp

passthrough

Mangle vs /tool/sniffer: When to Use Which

/tool/sniffer

sniff-tzsp

/tool/sniffer

file-name

/tool/sniffer

streaming-enabled

sniff-tzsp

/tool/sniffer/quick

TZSP Protocol Overview

TZSP is a simple UDP encapsulation — the router wraps the original Ethernet frame in a TZSP header and sends it as a UDP datagram:

UDP (port 37008) → TZSP header (4 bytes) → tags (variable) → TAG_END → original Ethernet frame

• Default port: 37008 (

  0x9090

  ) — not IANA-registered but the RouterOS/Wireshark standard
• Encapsulation: Typically Ethernet (type 1); 802.11 for wireless captures
• Tags: Optional metadata (WLAN signal strength, channel, etc.); Ethernet captures usually have no tags
• Keepalives: Type 4 (Null) packets sent periodically — no inner frame, filter these when processing

CHR Testing Pattern

A QEMU CHR instance provides a complete packet capture lab with zero hardware. The free CHR license has a 1 Mbps speed limit but this is sufficient for protocol debugging and sniffer testing.

# 1. Boot a CHR instance with port forwarding for REST API and SSH
qemu-system-x86_64 -M q35 -m 256 \
  -drive file=chr.img,format=raw,if=virtio \
  -netdev user,id=net0,hostfwd=tcp::9180-:80,hostfwd=tcp::9122-:22 \
  -device virtio-net-pci,netdev=net0 \
  -display none -serial stdio

# 2. Configure sniffer via REST API once booted
curl -u admin: -X POST http://<router-ip>/rest/tool/sniffer/set \
  -H 'Content-Type: application/json' \
  -d '{"streaming-enabled":"yes","streaming-server":"10.0.2.2:37008"}'

# 3. Start capture
curl -u admin: -X POST http://<router-ip>/rest/tool/sniffer/start

# 4. Listen for TZSP on the host
tshark -i any -f "udp port 37008" -O tzsp

# 5. Generate test traffic (e.g., ping from the CHR)
curl -u admin: -X POST http://<router-ip>/rest/ping \
  -H 'Content-Type: application/json' \
  -d '{"address":"8.8.8.8","count":"3"}'

QEMU user-mode networking note: The CHR's default gateway (10.0.2.2) is the host. Use this IP as

streaming-server

-netdev user

For full QEMU setup details, see the

routeros-qemu-chr

Gotchas

• Hardware-offloaded bridge traffic is NOT visible to the sniffer — only flooded packets (unknown unicast, broadcast, multicast) may appear
• Wireless client-to-client unicast with forwarding enabled is NOT visible
• Sniffed packets in memory expire after 10 minutes — save to file or use streaming for persistent capture
• PCAPNG format (RouterOS 7.20+) is the default for saved files — older tools may need PCAP

• filter-stream=yes

  (default) is important — without it, the sniffer captures its own TZSP stream packets, creating a feedback loop
• 1 Mbps CHR speed limit may cause "slow" captures — this is the free license limit, not a sniffer issue. See CHR licensing

• file-limit

  should not exceed free memory — the router may crash or behave unexpectedly

Cleanup

Always clean up sniffer config and mangle rules after debugging:

# Stop sniffer
/tool/sniffer/stop

# Reset sniffer config to defaults
/tool/sniffer
set streaming-enabled=no streaming-server=0.0.0.0 file-name=""

# Remove mangle rules (find by comment)
/ip/firewall/mangle/remove [find comment~"TZSP"]

Additional Resources

Reference files:

• For TZSP receiver setup (Wireshark, tshark, tcpdump): see TZSP receivers reference

Related skills:

• For QEMU CHR setup and boot patterns: see

  routeros-qemu-chr

  skill
• For CHR licensing (free tier, 60-day trial, speed limits): see

  routeros-qemu-chr

  skill
• For RouterOS CLI/REST basics: see

  routeros-fundamentals

  skill
• For the

  /console/inspect

  command tree: see

  routeros-command-tree

  skill

MCP tools:

• For RouterOS docs lookup: use the

  rosetta

  MCP server tools (

  routeros_search

  ,

  routeros_get_page

  )