It turns out that the MikroTik router sends UDP datagrams to port 37008 on the streaming-server IP address, containing a TZSP packet. Don't forget to stop the sniffer later, otherwise it will keep running until rebooted. That's it! You should start to see frames streaming in on the Wireshark display. Replace the IP address as appropriate, of course.įinally, start the sniffer. The filter parts are optional, but I find it very helpful to only observe one of the interfaces. Next, configure the sniffer tool on the MikroTik box.

I'm not sure if this makes a difference, I have yet to test re-enabling it. Firewalls should also be configured appropriately to allow this traffic.Īccording to one site (, link below), you should also disable WCCP protocol interpretation in Wireshark. You should also be able to use 'udp dst port 37008' instead, if you like. You should set a capture filter of 'udp port 37008' to only capture the sniffer traffic, excluding traffic directed or originating from your monitoring machine. I've also tested this setup over wifi to an AP that is then connected to the MikroTik box.) (Promiscuous/monitor mode is not necessary, everything works fine even on Windows 7. This may be a wired or wireless interface. How do I get it working?įirst, launch Wireshark, and start a capture on the interface that's connected to the MikroTik box. I was using Windows 7 (64-bit) and Wireshark 1.12.6, on a Thinkpad X220 using the onboard gigabit ethernet port and Intel 6205 802.11n card. This was tested on RouterOS v6.27 (mipsbe) and v6.28 (smips), but it should work mostly the same everywhere. You know how the MikroTik wiki and forums are, plus how Stack Overflow is.

This is a quick post to let Google pick it up. Live packet captures using MikroTik RouterOS and Wireshark

Mikrotik packet sniffer wireshark