Question about RouterOS /tool sniffer

RouterOS General
1

Hi there,

I’ve previously successfully used Wireshark to read sniffed packets from the RouterOS “/tool sniffer”. This is a great tool, but I’m confused as to how it actually works. (The docs are here: http://wiki.mikrotik.com/wiki/Manual:Tools/Packet_Sniffer)

As I understand it, the sniffer encapsulates packets in “TZSP” protocol and then uses UDP to transmit the TZSP to whatever IP I specify. e.g., “streaming-server: 10.1.10.31”.

But there is nowhere that I specify a port for that UDP to be sent to! How does Wireshark know where to look for the TZSP? Does TZSP have a standard port? If so, what is it? Otherwise, is it broadcasting those UDP packets? I feel like I’m missing something here.

Thanks.

2

I found an answer to my own question: the tzsp protocol automatically uses port 37008.