41 lines
2.2 KiB
Plaintext
41 lines
2.2 KiB
Plaintext
# MikroSuricata hybrid TZSP capture template.
|
|
# Review the target IP/port before importing. l2Interface="all" means all interfaces;
|
|
# set it to a real RouterOS interface/bridge only if you intentionally want to
|
|
# constrain the low-volume non-IPv4 stream.
|
|
|
|
:local target "172.31.255.2"
|
|
:local port 37008
|
|
:local l2Interface "all"
|
|
:local l2MacProtocol "!ip"
|
|
|
|
# Routed IPv4 uses mangle sniff-tzsp. The action passes processing to the next
|
|
# mangle rule after cloning the packet, so existing mangle rules remain active.
|
|
/ip/firewall/mangle/remove [find where comment="MikroSuricata TZSP IPv4"]
|
|
:if ([:len [/ip/firewall/mangle/find]] > 0) do={
|
|
/ip/firewall/mangle/add chain=forward action=sniff-tzsp sniff-target=$target sniff-target-port=$port comment="MikroSuricata TZSP IPv4" place-before=0
|
|
} else={
|
|
/ip/firewall/mangle/add chain=forward action=sniff-tzsp sniff-target=$target sniff-target-port=$port comment="MikroSuricata TZSP IPv4"
|
|
}
|
|
|
|
# Everything except IPv4 EtherType is streamed by Packet Sniffer. This includes
|
|
# ARP, IPv6, LLDP, PPPoE discovery and other non-IPv4 Ethernet protocols.
|
|
/tool/sniffer/stop
|
|
:if ($l2Interface != "all") do={
|
|
:if ([:len [/interface/find where name=$l2Interface]] = 0) do={
|
|
:error ("L2 capture interface not found: " . $l2Interface)
|
|
}
|
|
}
|
|
/tool/sniffer/set only-headers=no max-packet-size=2048 streaming-enabled=yes filter-stream=yes filter-interface=$l2Interface filter-mac-address="" filter-src-mac-address="" filter-dst-mac-address="" filter-mac-protocol=$l2MacProtocol filter-ip-address="" filter-src-ip-address="" filter-dst-ip-address="" filter-ipv6-address="" filter-src-ipv6-address="" filter-dst-ipv6-address="" filter-ip-protocol="" filter-port="" filter-src-port="" filter-dst-port="" filter-vlan="" filter-cpu="" filter-size="" filter-direction=any filter-operator-between-entries=or
|
|
|
|
# Current RouterOS uses streaming-server=IP:PORT. Fallback supports older builds
|
|
# that expose streaming-port separately.
|
|
:do {
|
|
/tool/sniffer/set streaming-server=($target . ":" . $port)
|
|
} on-error={
|
|
/tool/sniffer/set streaming-server=$target streaming-port=$port
|
|
}
|
|
/tool/sniffer/start
|
|
|
|
/ip/firewall/mangle/print stats where comment="MikroSuricata TZSP IPv4"
|
|
/tool/sniffer/print
|