https://xn--blgg-hra.no/2015/03/ids-with-mikrotik-and-snort/

tzsp2pcap

https://github.com/thefloweringash/tzsp2pcap

compile and prereqs

apt-get install vim curl sudo build-essential libpcap-dev libpcap0.8

git clone https://github.com/thefloweringash/tzsp2pcap.git

make

Running Wireshark

# ./tzsp2pcap -f | wireshark -i –

using this strips the tzsp headers and encapsulation headers

Using wireshark SSH remote capture

Debian 11 Notes

sha1 ciphers are removed by default, need to use dev chain of wireshark with never libssh for sshdump

Using dumpcap

/usr/bin/dumpcap -P -w – -i ztrf25twc4

With Filter Applied

/usr/sbin/dumpcap -i eth0 -f “host xxx.xxx.xxx.xxx” -w –

MQTT

-n vs -P n verses old pcap format

/usr/bin/dumpcap -n -w – -i br0 -f “port 1883”