Agent skill · data analytics · aiskillstore
routeros-sniffer
RouterOS packet capture and TZSP streaming for protocol debugging. Use when: capturing packets on RouterOS, setting up /tool/sniffer, streaming live traffic via TZSP, using firewall mangle action=sniff-tzsp, debugging network protocols on MikroTik, receiving TZSP with Wireshark or tshark, saving pcap files from RouterOS, or when the user mentions packet sniffer, TZSP, sniff-tzsp, /tool/sniffer, or packet capture on RouterOS.
Why this skill is useful
Provides specific RouterOS commands and configurations for packet capturing and TZSP streaming that the AI wouldn't reliably generate on its own.
What it needs
About 6k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
RouterOS Packet Capture & TZSP Streaming RouterOS has a built-in packet sniffer (/tool/sniffer) and firewall mangle actions that can mirror traffic — either saving to a file on the router or streaming live to a remote host via TZSP (TaZmen Sniffer Protocol). This is the primary way to capture packets on RouterOS since standard tools like tcpdump do not exist (see routeros-fundamentals skill). Why This Matters for Agents When debugging any network protocol issue on RouterOS, agents should know they can: 1. Stream live packets from the router to the host machine via TZSP — no hardware needed if using a CHR VM 2. Save pcap/pcapng files on the router's flash and download them for analysis 3. Use firewall mangle rules for surgical, per-flow packet mirroring without touching the sniffer config Combined with a QEMU CHR instance (see routeros-qemu-chr skill), this gives agents a complete packet-level debugging workflow with zero physical hardware. Method 1: /tool/sniffer (Full Capture Tool) The built-in sniffer captures packets on specified interfaces with extensive filtering. It supports three independent output modes that can be combined: Output Setting Notes -------- --------- ------- Memory buffer (always on) Viewable via quick, packet, protocol, host, connection submenus. Packets available for 10 minutes File on flash file-name=capture.pcap PCAPNG format since RouterOS 7.20 TZSP stream streaming-enabled=yes UDP to streaming-server on streaming-port (default 37008) Live TZSP Streaming The receiver host runs Wireshark, tshark, or another TZSP-capable tool (see TZSP receivers reference). File-Based Capture File + streaming can run simultaneously: Quick Mode (Interactive CLI) For quick one-off inspection directly on the router console: This shows a live scrolling table on the console with source/dest MAC, IP, protocol, and size. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/routeros-sniffer