First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Any way for clean packets from TZSP

Hello everyone, I use my MikroTik for capture remote wi-fi traffic and it works good with WireShark, but sometimes I need clearance this packets from TZSP header. May be someone can help me, - how I can save only payload from captured wi-fi packages without TZSP header?

rz3dvp's avatar
3
rz3dvp
asked 2021-03-29 07:56:59 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

2 Answers

0

TZSP is the wrapper protocol that MikroTik uses to stream the capture to another device.

To remove TZSP you can either:

  1. Perform an in-device capture on the MikroTik, but you'll be limited by the memory\storage space on the device.
  2. Use a tool to strip the TZSP from the capture, A Google search found tzsp2pcap that acts as the receiver and writes out the data to a pcap file. I'm sure there are other solutions.
grahamb's avatar
23.8k
grahamb
answered 2021-03-29 08:13:42 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Thanks Graham, Yes, I'm use capture on file and it's 100% good way for smal captures but MikroTik don't have lot of memory for long time monitoring. I tred to use tzsp2pcap but it's don't work correct with wi-fi trafic.

rz3dvp's avatar rz3dvp (2021-03-29 08:36:01 +0000) edit
more
  • delete
add a comment see more comments
0

If the TZSP header is a constant length, you can remove it with editcap.

$ editcap.exe -C 47 ./200909_MikroTik_TZSP.pcapng ./200909_MikroTik_TZSP_chop.pcapng

The Mikrotik I tested with had a 47 byte header: 14 (eth) + 20 (IP) + 8 (UDP) + 5 (TZSP) = 47
There are many option tags available in TZSP that could make the header length variable but my test device didn't use them. YMMV.

TZSP: Ethernet 
    Version: 1
    Type: Received packet (0)
    Encapsulation: Ethernet (1)
    End
        Option Tag: End (1)
Chuckc's avatar
3k
Chuckc
answered 2021-03-29 14:48:09 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Thanks, Chuck. It's a good idea, this method requires manual adjustments to the pcap file, but works well. I think this will solve my problem.

rz3dvp's avatar rz3dvp (2021-03-30 09:45:20 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer