Ask Your Question

Any way for clean packets from TZSP

asked 2021-03-29 07:56:59 +0000

rz3dvp gravatar image

Hello everyone, I use my MikroTik for capture remote wi-fi traffic and it works good with WireShark, but sometimes I need clearance this packets from TZSP header. May be someone can help me, - how I can save only payload from captured wi-fi packages without TZSP header?

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2021-03-29 14:48:09 +0000

Chuckc gravatar image

If the TZSP header is a constant length, you can remove it with editcap.

$ editcap.exe -C 47 ./200909_MikroTik_TZSP.pcapng ./200909_MikroTik_TZSP_chop.pcapng

The Mikrotik I tested with had a 47 byte header: 14 (eth) + 20 (IP) + 8 (UDP) + 5 (TZSP) = 47
There are many option tags available in TZSP that could make the header length variable but my test device didn't use them. YMMV.

TZSP: Ethernet 
    Version: 1
    Type: Received packet (0)
    Encapsulation: Ethernet (1)
        Option Tag: End (1)
edit flag offensive delete link more


Thanks, Chuck. It's a good idea, this method requires manual adjustments to the pcap file, but works well. I think this will solve my problem.

rz3dvp gravatar imagerz3dvp ( 2021-03-30 09:45:20 +0000 )edit

answered 2021-03-29 08:13:42 +0000

grahamb gravatar image

TZSP is the wrapper protocol that MikroTik uses to stream the capture to another device.

To remove TZSP you can either:

  1. Perform an in-device capture on the MikroTik, but you'll be limited by the memory\storage space on the device.
  2. Use a tool to strip the TZSP from the capture, A Google search found tzsp2pcap that acts as the receiver and writes out the data to a pcap file. I'm sure there are other solutions.
edit flag offensive delete link more


Thanks Graham, Yes, I'm use capture on file and it's 100% good way for smal captures but MikroTik don't have lot of memory for long time monitoring. I tred to use tzsp2pcap but it's don't work correct with wi-fi trafic.

rz3dvp gravatar imagerz3dvp ( 2021-03-29 08:36:01 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-03-29 07:56:59 +0000

Seen: 1,608 times

Last updated: Mar 29 '21