capture filter syslog

Question

Hi All,

How can i filter packets using "capture filter" to filter syslog packets ?

Thanks

Answer 1

2

$ egrep -i syslog /etc/services
syslog          514/udp #

so try "udp port 514" or "udp port syslog".

answered 20 Jun '11, 11:35

Guy Harris ♦♦
17.4k●3●35●196
accept rate: 19%

[[email protected]:Active] / # grep syslog /etc/services

syslog 514/udp

syslog-conn 601/tcp # Reliable Syslog Service

syslog-conn 601/udp # Reliable Syslog Service

[[email protected]:Active] / #

So you might want to use the filter "udp port 514 or port 601"

(22 Jun '11, 04:12) SYN-bit ♦♦

1

Note that the Reliable Syslog Service, as specified by RFC 3195, is very different from traditional syslog; it runs over BEEP, which runs over TCP.

While Wireshark has a BEEP dissector, it doesn't specifically know about the Reliable Syslog Service, so it might not dissect that as desired.

(23 Jun '11, 10:32) Guy Harris ♦♦

OK, learned something today, I did not know there was the BEEP protocol in between, actually, I did not know the reliable syslog service was more than just syslog over TCP.

On my NetScreen I can use syslog over TCP, but by default that uses port 514 as it turns out. I did not check the port before on my NetScreen, so I just grepped in my virtual F5 box (on which I was logged in anyways) and assumed 601 was for syslog over TCP.

So all-in-all one might want to capture with "port 514 or tcp port 601" :-)

(23 Jun '11, 12:19) SYN-bit ♦♦