up vote 0 down vote favorite
share [g+] share [fb]

My company is trying to export the live captured packet syslogs to a device within the network. We were just wondering if it is actually possible to do it with the Wireshark acting as a syslog relay server? Thanks.

link|improve this question
Not sure I understand. Are you trying to monitor what data is being sent to/from a syslog device? The .pcap file format is actually a generic capture format - you can do a capture on any device using any software and load it in Wireshark and it will be able to read it fine. – Mark Henderson♦ Aug 30 '10 at 2:49
Please refer to my comment below. Thanks. – VMNoob Aug 30 '10 at 2:52
I have two questions - 1 do you need to do this in real time ? 2 if answer to one is yes, then why not capture the packets on the machine your relaying them to ? – c10k Consulting Aug 30 '10 at 3:56
Cause it will defeat the whole purpose of setting up a network infrastructure.... – VMNoob Aug 31 '10 at 2:56
feedback

1 Answer

up vote 1 down vote accepted

Wireshark syslogs? Do you mean the standard wireshark packet captures? If so, I don't know of any easy way to stream those messages to another server.

Have you considered using tcpdump instead? That's what wireshark uses under the hood, and it's a command-line program. This would make it quite easy to run tcpdump remotely via ssh and save the output to a file on the local system.

link|improve this answer
Yea I was referring to the packet Captures as we were thinking of transfering real time packet captures to another syslog server etc. Kiwi Server. Thanks. – VMNoob Aug 30 '10 at 2:51
something like this on the destination server netcat -l 3030 | tcpdump -r - and this on the source server tcpdump -w - | netcat destserver 3030 would stream it, but I fail to see the point. – c10k Consulting Aug 30 '10 at 4:26
@c10k You're going to end up with some serious recursion issues there. – ErikA Aug 30 '10 at 5:04
for sure, I had not put any filtering in the tcpdump -w - but you get the idea ;-) – c10k Consulting Aug 30 '10 at 5:06
feedback

Your Answer

 
or
required, but never shown
discard