Mirroring traffic on MikroTik RB750Gr3 running OpenWrt 24.10.0

Hi.
I have MikroTik RB750Gr3 , I flashed openwrt 24.10.0 into it. I'm trying to set up port mirroring for debugging and monitoring traffic using a computer with wireshark installed.

I read this topic: this
I saved the script to myself, with only the changes that I have
mirrorPort=lan5
Installed tc-full and ip-full packages

Doesn't work :slightly_frowning_face:

Outputs errors in ssh:

RTNETLINK answers: Not supported
We have an error talking to the kernel
RTNETLINK answers: Not supported
We have an error talking to the kernel

Tried step-by-step:

ip link set up dev lan5

worked without any messages

tc qdisc add dev wan clsact

Also worked without any messages

tc filter add dev wan ingress matchall skip_sw action mirred egress mirror dev lan5

And here is the error:

RTNETLINK answers: Not supported
We have an error talking to the kernel

following it

tc filter add dev wan egress matchall skip_sw action mirred egress mirror dev lan5

causes the same reaction
This method does not work.

Maybe the package port-mirroring will work?

https://openwrt.org/packages/pkgdata/port-mirroring
[https://github.com/mmaraya/port-mirroring]mmaraya/port-mirroring](https://openwrt.org/packages/pkgdata/port-mirroring)

I installed this software.

config:
/etc/config/port-mirroring

 config 'port-mirroring'
     option source_ports 'wan'    # interfaces (maximum of 4) to copy packets from    
     option promiscuous  '1'             # put source interface(s) in promiscuous mode
     option target       'lan5'      # interface or IP address to send packets to
     option protocol     'TEE'           # 'TEE' iptables (default) or 'TZSP' TaZmen S
     option filter       ''              # optional tcpdump/libpcap packet filter expr

Log:
logread |grep port-mirroring

Mon May 19 20:13:53 2025 daemon.info port-mirroring[2104]: port-mirroring starting
Mon May 19 20:13:53 2025 daemon.info port-mirroring[2104]: command-line argument[1]: --daemon
Mon May 19 20:13:53 2025 daemon.info port-mirroring[2104]: command-line argument[2]: --syslog
Mon May 19 20:13:53 2025 daemon.info port-mirroring[2104]: background process mode selected
Mon May 19 20:13:53 2025 daemon.info port-mirroring[2104]: successfully read config file '/etc/config/port-mirroring'
Mon May 19 20:13:53 2025 daemon.info port-mirroring[2133]: using process id 2133
Mon May 19 20:13:53 2025 daemon.info port-mirroring[2133]: settings: src=wan dst=lan5 proto=TEE promisc=on filter=''
Mon May 19 20:13:53 2025 daemon.info port-mirroring[2133]: POSIX threads unavailable, running single-threaded

Doesn't work. Wireshark doesn't show any traffic from wan.
I'll try changing option source_ports to eth0 and reboot the device:

Mon May 19 20:38:20 2025 daemon.info port-mirroring[6150]: using process id 6150
Mon May 19 20:38:20 2025 daemon.info port-mirroring[6150]: settings: src=eth0 dst=lan5 proto=TEE promisc=on filter=''
Mon May 19 20:38:20 2025 daemon.info port-mirroring[6150]: POSIX threads unavailable, running single-threaded

Nothing interesting appeared.
Maybe I should set up a switch and somehow make mirroring on it?
I install the swconfig and kmod-swconfig packages:

swconfig list
doesn't display anything. Apparently, there is no switch support.

root@OpenWrt:~#cat /proc/cpuinfo 
system type		: MediaTek MT7621 ver:1 eco:3
machine			: MikroTik RouterBOARD 750Gr3

So, the question is: How is it customary to solve such a problem on a router with MT7621 in 2025? :thinking:

It seems that even though it is enabled, hw-tc-offload is not being respected.
Change the flag to skip_hw or just omit it.

This way it works.

1 Like

Thanks. Changed the flag to skip_hw. So mirroring really works.

However, the port lan5 continues to function as a general-purpose port, which in my opinion is inconvenient for analysis - after all, I want to get an exact copy of the traffic on the WAN and nothing extra, regardless of the settings of the ethernet interface on the computer with wireshark.

Tune this port is additional task...