RouterOS Packet Capture & TZSP Streaming

RouterOS has a built-in packet sniffer (/tool/sniffer) and firewall mangle actions that can mirror traffic — either saving to a file on the router or streaming live to a remote host via TZSP (TaZmen Sniffer Protocol). This is the primary way to capture packets on RouterOS since standard tools like tcpdump do not exist (see routeros-fundamentals skill).

Why This Matters for Agents

When debugging any network protocol issue on RouterOS, agents should know they can:

1. Stream live packets from the router to the host machine via TZSP — no hardware needed if using a CHR VM
2. Save pcap/pcapng files on the router's flash and download them for analysis
3. Use firewall mangle rules for surgical, per-flow packet mirroring without touching the sniffer config

Combined with a QEMU CHR instance (see routeros-qemu-chr skill), this gives agents a complete packet-level debugging workflow with zero physical hardware.

Method 1: /tool/sniffer (Full Capture Tool)

The built-in sniffer captures packets on specified interfaces with extensive filtering. It supports three independent output modes that can be combined: