- Language
- 🐍 Python
- Package
dojo-tzsp·import dojo.tzsp- Latest version
- 0.1.0 · 10 November 2026
- Requires
- Python ≥ 3.9
- Dependencies
- none
- License
- MIT
- Language
- 🐘 PHP
- Package
dojo/tzsp·Dojo\Tzsp- Latest version
- 0.1.0 · 10 November 2026
- Requires
- PHP ≥ 8.1
- Dependencies
- none
- License
- MIT
Works with: Any RouterOS with sniffer streaming or mangle sniff-tzsp rules. Verified against RouterOS 7.25 (real TZSP packets). Python 3.9+.
Independent MikroTik Dojo project library: it is not MikroTik software nor is it approved by MikroTik. Test it in a lab first.
Installation and usage
Installation (Python)
pip install --index-url https://mikrotikdojo.com/en/pypi/<your-address>/simple/ dojo-tzspThe library is installed with pip from the dojo index, using a personal URL reserved for dojo members. Joining is free: you only need your email.
Usage example (Python)
from dojo.tzsp import TzspReceiver, ethernet
with TzspReceiver() as rx: # ascolta su 0.0.0.0:37008
for addr, pkt in rx.packets():
eth = ethernet(pkt.payload) # dissezione L2 minimale
vlan = " vlan%s" % eth["vlan"] if eth["vlan"] else ""
print(addr[0], eth["src"], "->", eth["dst"], eth["type_name"] + vlan)
# decodificare un singolo datagramma gia' catturato:
from dojo.tzsp import decode
pkt = decode(data)
print(pkt.version, pkt.protocol_name, len(pkt.payload))Installation (PHP)
composer config repositories.dojo composer https://mikrotikdojo.com/en/composer/<your-address>/
composer require dojo/tzspThe library is installed with Composer from the dojo repository, using a personal URL reserved for dojo members. Joining is free: you only need your email.
Usage example (PHP)
use Dojo\Tzsp\TzspReceiver;
use Dojo\Tzsp\Tzsp;
$rx = new TzspReceiver(); // 0.0.0.0:37008
foreach ($rx->packets() as [$addr, $pkt]) {
$eth = Tzsp::ethernet($pkt->payload);
echo "$addr {$eth['src']} -> {$eth['dst']} {$eth['type_name']}\n";
}
// decodificare un singolo datagramma gia' catturato:
$pkt = Tzsp::decode($data);
echo $pkt->version, " ", $pkt->protocolName(), " ", strlen($pkt->payload), "\n";What it does
dojo.tzsp reads MikroTik’s «remote sniffer». RouterOS can mirror packets to another machine by wrapping them in TZSP (TaZmen Sniffer Protocol, UDP port 37008), either with /tool sniffer streaming or with /ip firewall mangle action=sniff-tzsp rules. Each datagram is a small TZSP header followed by the original frame (usually Ethernet).
What it does: opens a UDP receiver, decodes the TZSP header (version, type, encapsulated protocol, optional fields like RSSI/SNR/channel) and extracts the inner frame; a helper does minimal Ethernet dissection (source/destination MAC, 802.1Q/802.1ad VLANs traversed, ethertype). From there the frame is ready: analyse it, save it to a pcap, or pass it to scapy/dpkt.
When it helps: analysing traffic remotely without sitting at the router, selectively capturing a flow, debugging VLANs and L2, feeding a monitoring pipeline. It is the same technique used in WAN sniffers.
Caution: TZSP travels in cleartext — send the mirror only over trusted networks — and it can generate a lot of traffic: filter the sniff-tzsp rules well and remove them when done. No external dependencies (standard library only).
Versions
| Version | News | File |
|---|---|---|
| 0.1.0 PHP latest 10 November 2026 | First public release (PHP). Requires only PHP 8.1+ (no extra extensions). Namespace |
|
| 0.1.0 Python latest 10 November 2026 | First public release. UDP receiver, TZSP decoder (header + optional fields) and minimal Ethernet/VLAN dissection. No external dependencies (standard library only). |
Each file has its SHA-256 fingerprint (pip and Composer check it automatically) and an OpenTimestamps proof registered on Bitcoin: anyone can verify that the file is the one published on that date. Files are downloaded only if you are in the dojo.
How-tos that use it
Frequently asked questions
What is TZSP?
TaZmen Sniffer Protocol: a UDP encapsulation (port 37008) that carries a captured packet inside a datagram, with a small header. MikroTik uses it for the remote sniffer, but it is a format used by several devices.
How do I enable it on RouterOS?
Streaming: /tool sniffer set streaming-enabled=yes streaming-server=<your-ip> then start. Or selective: /ip firewall mangle add action=sniff-tzsp sniff-target=<your-ip> sniff-target-port=37008 .... Remember to remove the rules when done.
Are the packets encrypted?
No, TZSP is cleartext: anyone on the path sees the mirrored packets. Use it on trusted networks or inside a tunnel.
Does it work with CRS switches?
The mirror still arrives; but on some switches hardware forwarding bypasses the CPU, so /tool sniffer there only sees CPU-bound traffic. For the traffic you care about use a mangle sniff-tzsp rule.
What's in the payload I get?
The original captured frame, usually Ethernet. The ethernet() helper extracts MAC and VLANs; for L3/L4 pass the payload to a dedicated library (scapy, dpkt) or write it to a pcap.