Save Torch logs to a local machine

RouterOS Beginner Basics
1

I want to capture all network activity that is passing through the WANs & Bridge and save it in a local/LAN machine continuously (for future analysis).
can we save the logs along the timestamp?
if so, please guide me.

Thanks.

2

I don’t think you can save the Torch logs. But you could look at the Packet Sniffer tool. That can stream the capture to another machine where you can using Wireshark or Tshark to save it.

3

thanks, is there any related tutorial for this, any one mentioned/explained some place to get more details?

4

There is https://help.mikrotik.com/docs/display/ROS/Packet+Sniffer, but that doesn’t say much about the streaming bit. It isn’t all that difficult, though. Using Winbox, enable streaming (Tools → Packet Sniffer → Streaming) by putting in the IP address of the machine you’re running your capture on and checking ‘Enable Streaming’. On the capture box, run something like Wireshark (GUI) or Tshark (CLI) with a capture filter grabbing UDP port 37008. Save the incoming packets in a capture file, and Wreshark et al wil recognize and decode the payload as your Packet Sniffer capture.

5

https://wiki.mikrotik.com/wiki/Manual:Tools/Packet_Sniffer#Summary
Here it says we can monitor max 16 mac’s !!
I was expecting to capture for whole IP pool and save the logs !

(Torch was good, showing full IO details of Bridge or WANs)

6

No, it says you can capture a maximum of 16 different MAC protocols. A filter like “filter-ip-address 192.168.1.0/24” will work just fine.

7

Thanks.