# MikroSuricata hybrid TZSP capture template.
# Review the target IP/port before importing. l2Interface="all" means all interfaces;
# set it to a real RouterOS interface/bridge only if you intentionally want to
# constrain the low-volume non-IPv4 stream.

:local target "172.31.255.2"
:local port 37008
:local l2Interface "all"
:local l2MacProtocol "!ip"

# Routed IPv4 uses mangle sniff-tzsp. The action passes processing to the next
# mangle rule after cloning the packet, so existing mangle rules remain active.
/ip/firewall/mangle/remove [find where comment="MikroSuricata TZSP IPv4"]
:if ([:len [/ip/firewall/mangle/find]] > 0) do={
    /ip/firewall/mangle/add chain=forward action=sniff-tzsp sniff-target=$target sniff-target-port=$port comment="MikroSuricata TZSP IPv4" place-before=0
} else={
    /ip/firewall/mangle/add chain=forward action=sniff-tzsp sniff-target=$target sniff-target-port=$port comment="MikroSuricata TZSP IPv4"
}

# Everything except IPv4 EtherType is streamed by Packet Sniffer. This includes
# ARP, IPv6, LLDP, PPPoE discovery and other non-IPv4 Ethernet protocols.
/tool/sniffer/stop
:if ($l2Interface != "all") do={
    :if ([:len [/interface/find where name=$l2Interface]] = 0) do={
        :error ("L2 capture interface not found: " . $l2Interface)
    }
}
/tool/sniffer/set only-headers=no max-packet-size=2048 streaming-enabled=yes filter-stream=yes filter-interface=$l2Interface filter-mac-address="" filter-src-mac-address="" filter-dst-mac-address="" filter-mac-protocol=$l2MacProtocol filter-ip-address="" filter-src-ip-address="" filter-dst-ip-address="" filter-ipv6-address="" filter-src-ipv6-address="" filter-dst-ipv6-address="" filter-ip-protocol="" filter-port="" filter-src-port="" filter-dst-port="" filter-vlan="" filter-cpu="" filter-size="" filter-direction=any filter-operator-between-entries=or

# Current RouterOS uses streaming-server=IP:PORT. Fallback supports older builds
# that expose streaming-port separately.
:do {
    /tool/sniffer/set streaming-server=($target . ":" . $port)
} on-error={
    /tool/sniffer/set streaming-server=$target streaming-port=$port
}
/tool/sniffer/start

/ip/firewall/mangle/print stats where comment="MikroSuricata TZSP IPv4"
/tool/sniffer/print