Packet sniffer is streaming your traffic to a remote host

What the audit found

The packet sniffer under Tools → Packet Sniffer has streaming enabled, with a streaming server address configured. In this mode the router does not just capture packets to a file: it sends a live copy of the traffic it sees to a remote host using the TZSP protocol, where a tool such as Wireshark can read it.

The audit rates this high because it is either something you set up deliberately for a short debugging session and forgot, or it is a sign that the router has been compromised and someone is intercepting your traffic. The title of the finding shows the address the traffic is being sent to.

Why it matters

The packet sniffer is a legitimate and useful feature. Network administrators use streaming to look at a live capture from a remote router without filling its storage. But it is also the ideal tool for an intruder, and it has been used that way in real attacks on MikroTik devices: after gaining access through a known bug or a guessed password, attackers configured the sniffer to forward traffic to a server they controlled. Hundreds of routers were found doing this in 2018, and the technique has not gone away.

What leaks depends on the filter, but with the default settings it is everything that crosses the router: DNS queries, unencrypted HTTP, e-mail protocols without TLS, printer and file-share traffic, VoIP signalling, and the metadata of encrypted connections — which sites, when, how much. That is a complete picture of your network's activity, delivered continuously to whoever configured it.

If you do not recognise the streaming server address, treat the router as compromised. Disabling the sniffer removes the symptom, but the attacker still has whatever access they used to configure it, and there may be other changes — new users, scheduler entries, altered DNS settings — that you have not found yet.

What it looks like in Winbox

Open Tools → Packet Sniffer and look at the Streaming tab. Streaming Enabled will be ticked and Streaming Server shows the destination address. The General tab may show a filter limiting which interfaces or protocols are captured; the Running indicator tells you whether the capture is active right now.

How to fix it

The immediate fix is to switch streaming off: untick Streaming Enabled on the Streaming tab of Tools → Packet Sniffer, and if a capture is currently running, press Stop as well. This has no effect on normal router operation and does not touch your management session, so Safe Mode is not required.

Then decide which case you are in. If you configured streaming yourself and simply forgot, you are done — but next time, stop the sniffer at the end of the session. If you did not set this up, assume an intruder has full access and work through the rest of the device before trusting it again: System → Users for accounts you did not create (and change every password), System → Scheduler and System → Scripts for entries you do not recognise — attackers use these to re-apply their changes — and IP → DNS, IP → Socks, IP → Proxy and IP → Firewall → NAT for redirects. Upgrade RouterOS, make sure the input firewall drops traffic from the WAN, and where possible reset to defaults and rebuild from a known-good export rather than cleaning in place. If the streaming address is an internet host, it is worth reporting to your ISP or abuse contact.

Afterwards, confirm on the Streaming tab that streaming is off and the sniffer is not running, and if you have monitoring at the network edge, check that the router no longer sends UDP traffic to the former streaming address (TZSP uses port 37008 by default). Then re-run the audit: the finding should disappear, and any other signs of compromise it reports deserve the same attention.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I use streaming for troubleshooting with Wireshark. Do I have to stop?

No — it is a proper tool. Enable it for the session, disable it afterwards, and restrict the capture with a filter to the interface and protocol you are debugging. The audit will flag it whenever it is left on, which is a useful reminder.

The streaming server is an address on my own network. Is that still a problem?

Less alarming, but still worth checking. It could be a monitoring box a colleague set up, or a compromised workstation being used as a collection point. Confirm who owns the destination and why. If nobody claims it, treat it as an intrusion.

Can I find out how long this has been running?

The configuration itself carries no timestamp. Look at Log for entries about the sniffer or for logins from unfamiliar addresses, and at the file dates of any capture files under Files. If the log has wrapped, you may never know — one more reason to send logs to a remote syslog server.