After sniffer stops, poll /file/print every 500ms (up to 10s) until RouterOS reports the capture file, then use the exact 'name' field as the SFTP path. Falls back to stripping the leading slash if the first attempt gets "No such file". Eliminates the hardcoded path assumption. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>