Sniffer tool not working.

RouterOS Beginner Basics
1

Hello. I’m trying to capture and view traffic on ether2. I know there is traffic TX and RX on the Ethernet interface as I have verified this with:

/interface monitor-traffic interface=ether2

    rx-packets-per-second:         7
      rx-drops-per-second:         0
     rx-errors-per-second:         0
       rx-bits-per-second:  30.8kbps
    tx-packets-per-second:         8
      tx-drops-per-second:         0
     tx-errors-per-second:         0
       tx-bits-per-second:  33.7kbps
-- [Q quit|D dump|C-z pause]

I am using the sniffer tool from WinBox, but I am not seeing anything. I have tested via the CLI using “quick mode” but again I am not seeing any traffic being displayed. The command I am using is:

/tool sniffer quick interface=ether2

And the output is simply:

INTERFACE     TIME    NUM DI SRC-MAC           DST-MAC           VLAN   SRC-ADDRESS

[admin@MTik_ZZ] /tool sniffer>

Ultimately I want to be able to view a dump in Wireshark, but I cannot as yet even dump to screen any traffic at all…

Can you explain this?

Resources:
http://wiki.mikrotik.com/wiki/Manual:Tools/Packet_Sniffer#Quick_mode

2

Anybody?

3

obviously you skipped reading “Manual:Tools/Packet Sniffer” part of Wiki too early.
hardly im can explain things better than Wiki, in that point, just conclude.
unconfigured and not started, yet, sniffer - will behave just like you depicted, respectively.

4

I have no idea what you are saying. But I will try to speculate as to why I am seeing this behavior… What I did not say in my first post is that I have configured ether2 as a slave of ether3 to take advantage of the ASIC/hardware-based switching and reduce load on the CPU. So since the CPU is not handling the frames should I sniff for the traffic Tx and Rx ether2 by sniffing on ether3 and filtering to the IP of the device attached to ether2?

5

check mikrotik WIki how sniffing commands/features works. ie syntax, options, modes and check some examples, both in wiki and in web/internet.
no, i din’t mean that, obviously.