Hello,
I want to know if there is a method to use the sniffer tool or something else to catch all dropped traffic from firewall. I would like to know if there are some rules that drop something and then allow the traffic if this is good. I would use it for debug purpose.
Is there a solution with the sniffer or another method to do this?
Thanks in advance.
Re: Mikrotik sniffer droped packets
Hi
Sniffer will capture all traffic on the interface / wire, so in incoming side before any rules are applied, and on the outgoing side after all changes/filtering has been applied.
Basically what one would see in the wire.
Sniffer will capture all traffic on the interface / wire, so in incoming side before any rules are applied, and on the outgoing side after all changes/filtering has been applied.
Basically what one would see in the wire.
Re: Mikrotik sniffer droped packets
You can also accomplish this goal by enabling logging on your drop rules ( or by making an explicit log + drop rule after your accept rules ).Hello,
I want to know if there is a method to use the sniffer tool or something else to catch all dropped traffic from firewall. I would like to know if there are some rules that drop something and then allow the traffic if this is good. I would use it for debug purpose.
Is there a solution with the sniffer or another method to do this?
Thanks in advance.
-
-
vecernik87
Forum Veteran
- Posts: 891
- Joined:
Re: Mikrotik sniffer droped packets
another way - mangle has action "sniff-tzsp". If you can define your rule in mangle same way as in filter, it will be evaluated before filter and therefore you can sniff packets which will be dropped in the next step. That of course means almost doubling your whole firewall rules... not sure if it is worth it...
Re: Mikrotik sniffer droped packets
instead accept or drop, use jump to specific custom Firewall chain, where you can have rule that logs , and rule that accepts or drops.
Who is online
Users browsing this forum: No registered users and 18 guests