Hello,
I have a quick question about how (and whether) packet sniffing on MikroTik that is used just as a switch works.
This is my setup:
IP device (192.168.2.3) -> eth -> MikroTik RB952Ui-5ac2nD (eth1-eth5 bridged) (192.168.2.2) -> eth -> MikroTik RB750Gr3 (eth2-eth5 bridged, eth1 WAN, NAT) (192.168.2.1) -> eth (WAN) -> modem -> internet
Using MK 192.168.2.1's packet sniffer, I can see some communication between 192.168.2.3 and internet. However, using same filter rules, I am unable to see this packets in MK 192.168.2.2, even though they surely had to pass through that switch.
I have tried TCP/UDP/ICMP from 192.168.2.3 to internet, but I can see nothing in MK 192.168.3.2. All I can see are the broadcasts & multicasts. Works same when using interface->torch instead of packet sniffer.
While writing this post, I have found this topic viewtopic.php?t=97768 and it looks like the reason is that the packets are not sent from switch to CPU. However the topic is outdated and not solved + I am getting syntax errors for the advised commands.
So I have tried to set it using WinBox GUI by going to Switch->Rule->New switch rule, setting "Ports" to my ethernet port and in "Action" checked "Copy to CPU"/"Redirect to CPU"/"Mirror", but I am getting "not supported for this switch(6)" error for all three action options. Is it really not supported or am I doing something wrong? Or is there some other way to achieve this?