RouterOS SFTP root maps to the device filesystem root, not /flash/. Capture file is written as /<name>.pcap, not /flash/<name>.pcap. Also stop any in-progress capture before reconfiguring, add a 2s flush delay between sniffer stop and SFTP download, improve error messages to expose exact failure point, and delete remote file after download. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>