routeros-snifferlisted

# RouterOS Packet Capture & TZSP Streaming RouterOS has a built-in packet sniffer (`/tool/sniffer`) and firewall mangle actions that can mirror traffic — either saving to a file on the router or streaming live to a remote host via TZSP (TaZmen Sniffer Protocol). This is the primary way to capture packets on RouterOS since standard tools like `tcpdump` do not exist (see `routeros-fundamentals` skill). ## Why This Matters for Agents When debugging any network protocol issue on RouterOS, agents should know they can: 1. **Stream live packets** from the router to the host machine via TZSP — no hardware needed if using a CHR VM 2. **Save pcap/pcapng files** on the router's flash and download them for analysis 3. **Use firewall mangle rules** for surgical, per-flow packet mirroring without touching the sniffer config Combined with a QEMU CHR instance (see `routeros-qemu-chr` skill), this gives agents a complete packet-level debugging workflow with zero physical hardware. ## Method 1: /tool/sniffer (Full Capture Tool) The built-in sniffer captures packets on specified interfaces with extensive filtering. It supports **three independent output modes** that can be combined: | Output | Setting | Notes | |--------|---------|-------| | Memory buffer | (always on) | Viewable via `quick`, `packet`, `protocol`, `host`, `connection` submenus. Packets available for 10 minutes | | File on flash | `file-name=capture.pcap` | PCAPNG format since RouterOS 7.20 | | TZSP stream | `streaming-en