Using Torch and Packet Sniffer in MikroTik for Diagnostics

Using Torch for Real-Time Traffic Analysis on MikroTik

Torch is RouterOS's built-in packet analysis tool — think of it as a lightweight version of Wireshark focused on traffic summarization. It shows you what IP addresses and protocols are using your bandwidth right now, making it invaluable for troubleshooting, identifying bandwidth hogs, and spotting unusual traffic.

Starting Torch on an Interface

In Winbox: Tools → Torch, select interface, click Start.

On CLI:

TEXT

/tool torch interface=ether1

This shows all traffic on ether1 grouped by IP/protocol.

Filtering Torch Output

TEXT

# By protocol
/tool torch interface=ether1 ip-protocol=tcp

# By port
/tool torch interface=ether1 port=80,443

# By specific IP
/tool torch interface=ether1 src-address=192.168.10.50

# By destination
/tool torch interface=ether1 dst-address=8.8.8.8

Understanding Torch Output Fields

Src. Address: source IP
Dst. Address: destination IP
Protocol: TCP, UDP, ICMP, etc.
Src. Port / Dst. Port: port numbers
Tx Rate / Rx Rate: current bandwidth consumption
Tx / Rx Packets: packet counts

Common Torch Use Cases

Case 1: Finding the bandwidth hog

TEXT

/tool torch interface=ether1 ip-protocol=any

Sort by Tx Rate. The top entries are your heaviest consumers right now.

Case 2: Confirming a firewall rule works

Apply a Torch filter for the traffic you just blocked. If it still shows traffic passing, your firewall rule isn't working as expected.

Case 3: Identifying unusual protocols

Filter for protocols you don't expect:

TEXT

/tool torch interface=ether1 ip-protocol=gre

GRE, ESP, or unusual UDP traffic might indicate a VPN tunnel, or it could indicate unauthorized tunneling.

Case 4: Troubleshooting a specific client

TEXT

/tool torch interface=bridge1 src-address=192.168.10.25

See everything that one client is sending and where it's going.

Torch vs Other Tools

Tool	Purpose
Torch	Real-time traffic snapshot per flow
Graphing	Historical traffic rates per interface
Accounting	Total bytes per IP over time
Connection Print	Current connection state table
Sniffer	Full packet capture (like Wireshark)

Running Packet Capture (Advanced)

For detailed per-packet analysis beyond what Torch shows:

TEXT

/tool sniffer start interface=ether1 filter-ip-address=192.168.10.50
/tool sniffer stop
/tool sniffer save file=capture.pcap

Download the .pcap file and open in Wireshark for deep analysis.

Torch takes 30 seconds to learn and instantly answers the question everyone asks during a network problem: "What traffic is actually flowing right now?" Make it your first diagnostic tool.