Users across the globe have been using this open-source application as a complete network analysis tool. I did this as I was investigating if my Pi-Hole works as expected and blocks beaconing hostnames for Samsung Smart TVs.Over the past few years, Wireshark has developed a reputation as one of the most reliable network protocol analyzers available on the market.

In this screenshot, you can see that I applied two extra display filters to see really only traffic from/to 192.168.1.150 IP and DNS related traffic. Review the sniffer status: > /tool sniffer printĪnd that’s it! This is how it could look like in your Wireshark GUI in the end. (In my case, I selected only IP of my Smart TV as I wanted to see what kind of traffic it sends/receives from Internet)

filter-ip-address – you can limit the sniffing to only a specific IP address(es).

(In my case, I have two radios 2,4 GHz & 5 GHz and I selected both)

filter-interface – interface(s) where the capture will happen.

streaming-server – IP address of the host where the Wireshark is running.

streaming-enabled – enables forwarding of packets.

tool sniffer set filter-interface wlan1,wlan2 Then configure sniffer options: /tool sniffer set streaming-enabled=yes streaming-server=192.168.1.100 I will show you how to do this via SSH/Telnet.įirst, connect to the device (ssh in my example): ssh -p PORT You can do this configuration via SSH, Telnet, WinBox or WebFig.

4) Configure MikroTik router to forward captured traffic On Wireshark’s main screen, select the filter you just created (click on the small green flag) and then start the capture. On the added line, write there a name of the filter (for example “MikroTik sniffing”) and set “ udp port 37008” as the filter. It will open a new window with capture filters.Ĭlick on “+” button to add a new line to the list. In Wireshark menu, click on “capture” and then select “capture filters”. Then log out and log in again to let the usermod change to take effect or simply reboot your system: $ sudo reboot 2) Configure Wireshark filter Then add your user to a “wireshark” group: $ sudo usermod -a -G wireshark '$USER' On Fedora you install Wireshark by: $ sudo dnf install wireshark

We will configure MikroTik router to stream captured packets to our computer where we will be capturing and analyzing them with Wireshark. Today, I will describe how to analyze traffic passing through a MikroTik router on your local machine with Wireshark.

Wireshark packet sniffer running