(In my case, I selected only IP of my Smart TV as I wanted to see what kind of traffic it sends/receives from Internet) filter-ip-address – you can limit the sniffing to only a specific IP address(es).(In my case, I have two radios 2,4 GHz & 5 GHz and I selected both) filter-interface – interface(s) where the capture will happen.

streaming-server – IP address of the host where the Wireshark is running.streaming-enabled – enables forwarding of packets.tool sniffer set filter-interface wlan1,wlan2

Then configure sniffer options: /tool sniffer set streaming-enabled=yes streaming-server=192.168.1.100 I will show you how to do this via SSH/Telnet.įirst, connect to the device (ssh in my example): ssh -p PORT You can do this configuration via SSH, Telnet, WinBox or WebFig. 4) Configure MikroTik router to forward captured traffic On Wireshark’s main screen, select the filter you just created (click on the small green flag) and then start the capture. On the added line, write there a name of the filter (for example “MikroTik sniffing”) and set “ udp port 37008” as the filter. It will open a new window with capture filters.Ĭlick on “+” button to add a new line to the list. In Wireshark menu, click on “capture” and then select “capture filters”. Then log out and log in again to let the usermod change to take effect or simply reboot your system: $ sudo reboot 2) Configure Wireshark filter Then add your user to a “wireshark” group: $ sudo usermod -a -G wireshark '$USER' On Fedora you install Wireshark by: $ sudo dnf install wireshark We will configure MikroTik router to stream captured packets to our computer where we will be capturing and analyzing them with Wireshark. Today, I will describe how to analyze traffic passing through a MikroTik router on your local machine with Wireshark.

Wireshark capture filter for ssh