'Torch' tool strange behavior.....?

RouterOS General
1

Have one border router (CCR running v6.4 updated firmware) connected to the provider’s internet router with ether1.
If I run a torch tool on this ether1 interface I see all traffic passing this interface.

If I now start a ping tool to a server on the internet, than this should be visible in the torch with the srce address of my ether1 interface and the dst address the remote server. But I don’t!

If I now actually set the remote address of the remote server in the “Dst. Address” field in torch and also filter for icmp traffic only, I don’t see this icpm traffic.
If I set the the remote address of the remote server in the “Srce Address” field in toch I do see the traffic of the ping session.
But it shows as having my router’s IP as destination and indeed the remote server as srce.

Why don’t I see the ping leaving my router? But see only the response of remote server?


Basically, if torch is running on this WAN port, I only see the incoming ‘return’ traffic. Not the traffic leaving the router… isn’t that strange?

2

so, you see zeroes in ‘Tx’ columns? that’s strange

about the fact that src and dst are “swapped” - Torch looks from the point of the selected interface. when it receives some packet on WAN, src-address is the address of remote server, so that’s how it should be

3

I have the same problem, maybe I am reading the torch display wrongly. What I see:
Torch reverses src-dst.jpg
Now what is it. I have eiop tunnel trhu wan with ipsec connecting two local networks together (routing, not bridging, so technically there is another network for eoip to pass traffic trhu - it is 192.168.222.0/30). I am at 192.168.1.5 sending repeating ping to 192.168.10.21 thru this tunnel. So, from my point of view, the torch should display both ways of packets, it means the ping request and the ping reply. But it does not. It shows only the incomming traffic (from the view of port) and not outgoing.

Why??

Can it be considered as bug?

See the connection from conntrack for comparison, it correctly states that how the connection is created.