Is there a way to have the mikrotik continously overwrite old sniffer data when the file reaches it’s max size? I know this is possible in some other firewalls I’ve worked with, eg, Zyxel USG series.
We need to have long running captures while we’re trying to isolate an intermittent problem with their VoIP, but don’t want to have huge capture files to download over our customers WAN connection. Ideally we want to keep the capture size to a few hundred megs and just have the MT overwrite the oldest data in the capture when it hits the size limit.
I also thought about streaming the capture to a remote syslog (or even locally), but then that eats into their limited bandwidth when we need to retrieve the data.
Thoughts?