Packet sniffer- not capturing traffic between ports 2 and 3

RouterOS General
1

Dear All,

Your assistance will be very much appreciated.

Objective:
Troubleshoot packet traffic between device on port 2 and port 3.

Current state
I fail to capture traffic between devices connected to ports, port 2 and port 3.
Packet sniffer captures traffic to/ from switch ok. This is not needed.

Hardware models I am testing this on:
a. CRS125-24G-1S
b. 960PGS (hEX PoE)
Both RouterOS 6.43.2.

Current configuration.on hEX PoE

> /interface bridge port print
Flags: X - disabled, I - inactive, D - dynamic, H - hw-offload

INTERFACE BRIDGE HW PVID PR PATH-COST INTERNA… HORIZON

0 H ether2-Master bridge1 yes 1 0x 10 10 none
1 H ether3 bridge1 yes 1 0x 10 10 none
2 H ether4 bridge1 yes 1 0x 10 10 none
3 H ether5 bridge1 yes 1 0x 10 10 none
4 I sfp1 bridge1 yes 1 0x 10 10 none

> /tool sniffer print
only-headers:no
memory-limit:100KiB
memory-scroll:yes
file-name:
file-limit:1000KiB
streaming-enabled:yes
streaming-server:10.1.4.2
filter-stream:yes
filter-interface:bridge1
filter-direction:any
filter-operator-between-entries:and

I tried specifying a particular port to capture. No change.
Tried, switch, mirror source and mirror target. No change.

Thank you,

2

As long as you have HW offload active, traffic between two ports of same switch chip will not be seen by CPU and hence not by packet sniffer. When you disable HW offload for “sniffed” port, traffic to/from should start passing CPU and you’ll be able to sniff it.
I’m not sure whether HW offload should be disabled automatically after start of sniffer tool or not …

3

Dear Mkx,

Tried solving this for 2 days, your suggestion solved the issue.
Strange some times how hard the smallest challenges can be when you simple do not know.

I am much obliged.
Thank you very much.