Language
🐍 Python
Package
dojo-tzsp · import dojo.tzsp
Latest version
0.1.0 · 10 November 2026
Requires
Python ≥ 3.9
Dependencies
none
License
MIT
Language
🐘 PHP
Package
dojo/tzsp · Dojo\Tzsp
Latest version
0.1.0 · 10 November 2026
Requires
PHP ≥ 8.1
Dependencies
none
License
MIT

Works with: Any RouterOS with sniffer streaming or mangle sniff-tzsp rules. Verified against RouterOS 7.25 (real TZSP packets). Python 3.9+.

Independent MikroTik Dojo project library: it is not MikroTik software nor is it approved by MikroTik. Test it in a lab first.

Installation and usage

Installation (Python)

pip install --index-url https://mikrotikdojo.com/en/pypi/<your-address>/simple/ dojo-tzsp

The library is installed with pip from the dojo index, using a personal URL reserved for dojo members. Joining is free: you only need your email.

Enter the dojo for free I am already registered

Usage example (Python)

from dojo.tzsp import TzspReceiver, ethernet

with TzspReceiver() as rx:                 # ascolta su 0.0.0.0:37008
    for addr, pkt in rx.packets():
        eth = ethernet(pkt.payload)         # dissezione L2 minimale
        vlan = " vlan%s" % eth["vlan"] if eth["vlan"] else ""
        print(addr[0], eth["src"], "->", eth["dst"], eth["type_name"] + vlan)

# decodificare un singolo datagramma gia' catturato:
from dojo.tzsp import decode
pkt = decode(data)
print(pkt.version, pkt.protocol_name, len(pkt.payload))

Installation (PHP)

composer config repositories.dojo composer https://mikrotikdojo.com/en/composer/<your-address>/
composer require dojo/tzsp

The library is installed with Composer from the dojo repository, using a personal URL reserved for dojo members. Joining is free: you only need your email.

Enter the dojo for free I am already registered

Usage example (PHP)

use Dojo\Tzsp\TzspReceiver;
use Dojo\Tzsp\Tzsp;

$rx = new TzspReceiver();                       // 0.0.0.0:37008
foreach ($rx->packets() as [$addr, $pkt]) {
    $eth = Tzsp::ethernet($pkt->payload);
    echo "$addr  {$eth['src']} -> {$eth['dst']}  {$eth['type_name']}\n";
}

// decodificare un singolo datagramma gia' catturato:
$pkt = Tzsp::decode($data);
echo $pkt->version, " ", $pkt->protocolName(), " ", strlen($pkt->payload), "\n";

What it does

dojo.tzsp reads MikroTik’s «remote sniffer». RouterOS can mirror packets to another machine by wrapping them in TZSP (TaZmen Sniffer Protocol, UDP port 37008), either with /tool sniffer streaming or with /ip firewall mangle action=sniff-tzsp rules. Each datagram is a small TZSP header followed by the original frame (usually Ethernet).

What it does: opens a UDP receiver, decodes the TZSP header (version, type, encapsulated protocol, optional fields like RSSI/SNR/channel) and extracts the inner frame; a helper does minimal Ethernet dissection (source/destination MAC, 802.1Q/802.1ad VLANs traversed, ethertype). From there the frame is ready: analyse it, save it to a pcap, or pass it to scapy/dpkt.

When it helps: analysing traffic remotely without sitting at the router, selectively capturing a flow, debugging VLANs and L2, feeding a monitoring pipeline. It is the same technique used in WAN sniffers.

Caution: TZSP travels in cleartext — send the mirror only over trusted networks — and it can generate a lot of traffic: filter the sniff-tzsp rules well and remove them when done. No external dependencies (standard library only).

Versions

VersionNewsFile
0.1.0 PHP latest
10 November 2026

First public release (PHP). Requires only PHP 8.1+ (no extra extensions). Namespace Dojo\Tzsp.

  • dojo-tzsp-0.1.0.zip 6.4 KB
    sha256 4da43b64d902bd9cff5581d00c89ad8815c124252cb4761c9b8ecf022ddbe54d
    .ots · confirmed in Bitcoin block 975,308
0.1.0 Python latest
10 November 2026

First public release. UDP receiver, TZSP decoder (header + optional fields) and minimal Ethernet/VLAN dissection. No external dependencies (standard library only).

  • dojo_tzsp-0.1.0-py3-none-any.whl 7.2 KB
    sha256 e66309b9e5ff8216d3e3e6778b474c033bea1ab6567b57cc3cf4a17f8031b403
    .ots · confirmed in Bitcoin block 975,308
  • dojo_tzsp-0.1.0.tar.gz 6.5 KB
    sha256 4935bc2dc22bb857a9ed5282b726978c3d8c74e2092f289c11633d27ef3574f1
    .ots · confirmed in Bitcoin block 975,308

Each file has its SHA-256 fingerprint (pip and Composer check it automatically) and an OpenTimestamps proof registered on Bitcoin: anyone can verify that the file is the one published on that date. Files are downloaded only if you are in the dojo.

How-tos that use it

Frequently asked questions

What is TZSP?

TaZmen Sniffer Protocol: a UDP encapsulation (port 37008) that carries a captured packet inside a datagram, with a small header. MikroTik uses it for the remote sniffer, but it is a format used by several devices.

How do I enable it on RouterOS?

Streaming: /tool sniffer set streaming-enabled=yes streaming-server=<your-ip> then start. Or selective: /ip firewall mangle add action=sniff-tzsp sniff-target=<your-ip> sniff-target-port=37008 .... Remember to remove the rules when done.

Are the packets encrypted?

No, TZSP is cleartext: anyone on the path sees the mirrored packets. Use it on trusted networks or inside a tunnel.

Does it work with CRS switches?

The mirror still arrives; but on some switches hardware forwarding bypasses the CPU, so /tool sniffer there only sees CPU-bound traffic. For the traffic you care about use a mangle sniff-tzsp rule.

What's in the payload I get?

The original captured frame, usually Ethernet. The ethernet() helper extracts MAC and VLANs; for L3/L4 pass the payload to a dedicated library (scapy, dpkt) or write it to a pcap.