 | 1 | initial version |
It is rather a question for the Mikrotik forum, however the answer is that you haven't chosen a particular interface to sniff at, so the Mikrotik sniffs at all of them. And as each packet captured on the /interface wireless is encapsulated into TZSP and sent out via one /interface ethernet to the internet and possibly via another '/interface ethernet' to your PC running Wireshark, I'm actually surprised that you don't have even more mess there, so I suspect Mikrotik doesn't copy packets which already have a TZSP header in them to the TZSP destination.
So to me, the Mikrotik receives a frame at the /interface wireless, the sniffer copies it to your PC with a TZSP header added, sends it out the uplink to the internet, and the sniffer sees it on the uplink interface again and so it copies it to your PC again.
On top of that, as you sniff not only on the /interface wireless and the uplink but also on the interface to which your PC is connected (or the same interface is used for uplink and for connection of your PC, I don't know your particular setup) and as no application at your PC listens at the TZSP port, the PC's network stack sends the ICMP destination unreachable to the Mikrotik.
So try to set the sniffing filter to wlan1 or what is the name of the /interface wireless you use and try again.
| | 2 | No.2 Revision |
It is rather a question for the Mikrotik forum, however the answer is that you haven't chosen a particular interface to sniff at, so the Mikrotik sniffs at all of them. And as each packet captured on the /interface wireless is encapsulated into TZSP and sent out via one /interface ethernet to the internet and possibly via another '/interface ethernet' /interface ethernet to your PC running Wireshark, I'm actually surprised that you don't have even more mess there, so I suspect Mikrotik doesn't copy packets which already have a TZSP header in them to the TZSP destination.destination again (and again, and again...)
So to me, the Mikrotik receives a frame at the /interface wireless, the sniffer copies it to your PC with a TZSP header added, sends it out the uplink to the internet, and the sniffer sees it on the uplink interface again and so it copies it to your PC again.
On top of that, as you sniff not only on the /interface wireless and the uplink but also on the interface to which your PC is connected (or the same interface is used for uplink and for connection of your PC, I don't know your particular setup) and as no application at your PC listens at the TZSP port, the PC's network stack sends the ICMP destination unreachable to the Mikrotik.
So try to set the sniffing filter to wlan1 or what is the name of the /interface wireless you use and try again.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
