Hello, guys!

I use CCR1036-12G-4S as aggregation and border router at the same time in my little ISP network.

I need to get copy of traffic from several IP-subnets passing via router in ordinary mirror format, without any incapsulation and direct it to monitoring server according the russian regulation law.
This model of router doesn't have switch chip for mirroring, so task can't be archived this way.

Is some simple way to convert (decapsulate) TSZP stream or PC-stream format on-the-fly to ordinary mirror stream by some software or application (linux packet flow processor, etс) exits?
TZSP sniff by mangle collects exactly needed streams and works great, so simple conversion decision will be best for me.

Have the Mikrotik team plans to add some kind of simple L3 traffic flow duplicate to ethernet port on CCR?
Is it possible to done my task with OpenFlow?

Dmitry.

Dmitry, did you solve this problem somehow?