Documentation of the packet flow (https://wiki.mikrotik.com/wiki/Manual:Packet_Flow) is probably the most visiting by me page on MikroTik Wiki . Question is where in the diagram should we locate such tools like Packet sniffer and Ping?
Why I asked? I would like to analyse IPsec traffic. From the router A I threw ICMP packets to the host behind the router B (with source address of the packet set as local router A address). Routers are connected by VPN IPSec tunnel. Looking at the log from the Packet sniffer, I see ESP traffic in both directions as well as ICMP replies from the local address of the queried host behind router B (so after decapsulating), but I don't see any ICMP queries with router's A local source address. Why is it?