Any way for clean packets from TZSP

asked 2021-03-29 07:56:59 +0000

rz3dvp
3 ●1 ●2 ●2

Hello everyone, I use my MikroTik for capture remote wi-fi traffic and it works good with WireShark, but sometimes I need clearance this packets from TZSP header. May be someone can help me, - how I can save only payload from captured wi-fi packages without TZSP header?

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2021-03-29 14:48:09 +0000

Chuckc
3023 ●6 ●608 ●20

If the TZSP header is a constant length, you can remove it with editcap.

$ editcap.exe -C 47 ./200909_MikroTik_TZSP.pcapng ./200909_MikroTik_TZSP_chop.pcapng

The Mikrotik I tested with had a 47 byte header: 14 (eth) + 20 (IP) + 8 (UDP) + 5 (TZSP) = 47
There are many option tags available in TZSP that could make the header length variable but my test device didn't use them. YMMV.

TZSP: Ethernet 
    Version: 1
    Type: Received packet (0)
    Encapsulation: Ethernet (1)
    End
        Option Tag: End (1)

edit flag offensive delete link

Comments

Thanks, Chuck. It's a good idea, this method requires manual adjustments to the pcap file, but works well. I think this will solve my problem.

rz3dvp ( 2021-03-30 09:45:20 +0000 )edit

add a comment

answered 2021-03-29 08:13:42 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●973 ●227 https://www.wireshark.org

TZSP is the wrapper protocol that MikroTik uses to stream the capture to another device.

To remove TZSP you can either:

Perform an in-device capture on the MikroTik, but you'll be limited by the memory\storage space on the device.
Use a tool to strip the TZSP from the capture, A Google search found tzsp2pcap that acts as the receiver and writes out the data to a pcap file. I'm sure there are other solutions.

edit flag offensive delete link

Comments

Thanks Graham, Yes, I'm use capture on file and it's 100% good way for smal captures but MikroTik don't have lot of memory for long time monitoring. I tred to use tzsp2pcap but it's don't work correct with wi-fi trafic.

rz3dvp ( 2021-03-29 08:36:01 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Any way for clean packets from TZSP

2 Answers

Comments

Comments

Your Answer

Question Tools

Stats

Related questions

Any way for clean packets from TZSP edit

2 Answers

Comments

Comments

Your Answer

Question Tools

Stats

Related questions

Any way for clean packets from TZSP