Running Packet Sniffer - MikroTik RouterOS v2.9 Reference Manual

Notes
filter-address1 and filter-address2 are used to specify the two participients in communication (i.e.
they will match only in the case if one of them matches the source address and the other one
matches the destination address of a packet). These properties are taken in account only if
filter-protocol is ip-only.
Not only Ethernal (
receive the sniffer's
http://www.mikrotik.com/download.html
received packets libpcap file format.
Example
In the following example streaming-server will be added, streaming will be enabled, file-name
will be set to test and packet sniffer will be started and stopped after some time:
[admin@MikroTik] tool sniffer>set streaming-server=10.0.0.241 \
\... streaming-enabled=yes file-name=test
[admin@MikroTik] tool sniffer> prin
interface: all
only-headers: no
memory-limit: 10
file-name: "test"
file-limit: 10
streaming-enabled: yes
streaming-server: 10.0.0.241
filter-stream: yes
filter-protocol: ip-only
filter-address1: 0.0.0.0/0:0-65535
filter-address2: 0.0.0.0/0:0-65535
running: no
[admin@MikroTik] tool sniffer>start
[admin@MikroTik] tool sniffer>stop

Running Packet Sniffer

Command name: /tool sniffer start , /tool sniffer stop , /tool sniffer save
Description
The commands are used to control runtime operation of the packet sniffer. The start command is
used to start/reset sniffering, stop - stops sniffering. To save currently sniffed packets in a specific
file save command is used.
Example
In the following example the packet sniffer will be started and after some time - stopped:
[admin@MikroTik] tool sniffer> start
[admin@MikroTik] tool sniffer> stop
Below the sniffed packets will be saved in the file named test:
[admin@MikroTik] tool sniffer> save file-name=test
[admin@MikroTik] tool sniffer> /file print
# NAME
Page 610 of 695
Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.
Other trademarks and registred trademarks mentioned herein are properties of their respective owners.
http://www.ethereal.com
stream
TYPE
) and Packetyzer (
but also MikroTik's
) that runs on any IA32 Linux computer and saves
SIZE
http://www.packetyzer.com
program
CREATION-TIME
) can
trafr (