[vetinari]

On RouterOS, the default 'admin' user is a member of the 'full' group, which has 'sniff' policy enabled.

So it can be both - dedicated user with the appropriate permission, or admin himself.