Feature request: add packet mark to packet sniffer filter

RouterOS General
1

It would be great if we can sniff only packets marked by specific packet mark in mangle.
For example, I need to get only first 3 packets from each TCP connection, but TZSP action is not suitable for me.

2

Mark when new and unmark when established? Or !new.

Update: I had to resort to connection-marking. This is a example but testing if it works is not possible in my live router.

add action=mark-connection chain=prerouting comment=Sniffer connection-state=new disabled=yes new-connection-mark=test passthrough=yes \
    protocol=tcp tcp-flags=""
add action=sniff-tzsp chain=prerouting comment=Sniffer connection-mark=test disabled=yes sniff-target=192.168.0.111 sniff-target-port=37008
add action=mark-connection chain=prerouting comment=Sniffer connection-mark=test disabled=yes new-connection-mark=no-mark passthrough=yes \
    protocol=tcp tcp-flags=!sync,ack

I past the code as being disabled.

3

If the reason is that you need to sniff to file directly at a remote Mikrotik device, there is a workaround. Create an IPIP tunnel with !keepalive (so that it appears to be always up) and set its MTU to, say, 1700. Then, create a route dst-address=100.100.100.100 gateway=the-ipip-interface. In the action=sniff-tzsp rule, set the sniff-target to 100.100.100.100. And let the sniffer sniff on the-ipip-interface.

4

Thank you for reply. I need to preserve original timestamp of a packet. If I am not wrong TZSP action will resend the packet to the Wireshark, but time of the packet will be the time when packet arrtives to wireshark and not from the router where it originates from.
So I want to store packets locally to the file.

5

If you do it the way I suggest, you’ll have local (Mikrotik) timestamps.

6

I’ll give it a try. Thank You.