Using /tool/sniffer to send sniffed packets from Mikrotik router wan interface.

Receiving on linux laptop with: tzsp2pcat -f

Unfortunately, the packets are post-nat and show the external ip address not the internal address. Except for a very small number of packets. I need to dig deeper out what's going on with them.

Is there an easy, or not so easy, way to fix this?

To see internal addresses, I'd try sniffing on LAN interface, and use external private IP to stream it to.

D'Oh!

I was looking at things crosseyed and I missed the bridge1 interface, which is what I now think is the correct configuration for what I want.

Double D'Oh!

I didn't see any responses, looked for this thread, didn't see it. And asked again. Sorry about that.

Remaining Puzzle

I still have the mystery regarding the few packets on the WAN interface with internal ip addresses. I'll keep looking into that.