TZSP to PCAP

https://xn--blgg-hra.no/2015/03/ids-with-mikrotik-and-snort/

tzsp2pcap

https://github.com/thefloweringash/tzsp2pcap

compile and prereqs

apt-get install libpcap-dev libpcap0.8

make

Running Wireshark

# ./tzsp2pcap -f | wireshark -i –

using this strips the tzsp headers and encapsulation headers

Using wireshark SSH remote capture