Revision history [back]

If the TZSP header is a constant length, you can remove it with editcap.

$ editcap.exe -C 47 ./200909_MikroTik_TZSP.pcapng ./200909_MikroTik_TZSP_chop.pcapng

The Mikrotik I tested with had a 47 byte header: 14 (eth) + 20 (IP) + 8 (UDP) + 5 (TZSP) = 47
There are many option tags available in TZSP that could make the header length variable but my test device didn't use them. YMMV.

TZSP: Ethernet 
    Version: 1
    Type: Received packet (0)
    Encapsulation: Ethernet (1)
    End
        Option Tag: End (1)