Duplicate Post from Reddit BTW:
Im very green to networking so apologies upfront if this is simple. And I did try some due diligence on trying to set it up myself but could not make progress.
Setup: Mikrotik hEX RB750Gr3, one sniffer client, one user client
Goal: use the router/managed switch to mirror the port the user client is on to the sniffer client and block any outgoing traffic the sniffer client may send. Make it so the sniffer client can only monitor/read traffic never respond. It would be nice if the sniffer client could be accessed through the local network by a specific ip but not necessary. The sniffer client is running a Npcap SDK / Wireshark to parse packets.
I’ve also seen reference of packet forwarding on the Mikrotik for remote Wireshark, I don’t see why that would not work as well but to be honest I just don’t know enough about networking to design this system.
Where I got stuck: Mirroring the traffic was fine, but setting up a firewall rule for just port 3 of the switch was not allowed, it instead wanted me to setup a rule for the bridge. Preferably I would like to block the traffic based of the interface/port so any sniffer client could be plugged in regardless of its IP and work.
attached is an image of the potential setup. Thanks in advance everyone!
